Unknown Forms vulnerabilities

• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action CVE-2026-106649 6.8 MediumNovember 4, 2026
• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing CVE-2026-107343 4.3 MediumNovember 1, 2026
• unknown kali forms — contact form & drag-and-drop builder Kali Forms < 2.4.30 - Subscriber+ User Email Address Disclosure CVE-2026-107342 4.3 MediumNovember 1, 2026
• themekraft buddyforms BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion CVE-2026-118437 3.7 LowOctober 31, 2026
• kendysond payment forms for paystack Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings Page CVE-2026-110042 4.9 MediumOctober 31, 2026
• themekraft buddyforms BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification CVE-2026-118101 5.3 MediumOctober 30, 2026
• themekraft buddyforms BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure CVE-2026-118100 5.3 MediumOctober 30, 2026
• brainstorm force sureforms WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability CVE-2026-116387 5.3 MediumOctober 29, 2026
• brainstorm force sureforms WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability CVE-2026-116402 5.3 MediumOctober 29, 2026
• saturday drive ninja forms Ninja Forms WordPress Plugin < 3.15.4 Server-Side Validation Bypass via List Fields CVE-2026-67187 5.1 MediumOctober 28, 2026
• unknown hipaa forms CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role CVE-2026-109927 7.2 HighOctober 22, 2026
• unknown happyforms HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via client_referer CVE-2026-14556 5.4 MediumOctober 21, 2026
• kevin stover ninja forms WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability CVE-2026-110899 Public exploit 7.1 HighOctober 21, 2026
• unknown formidable forms Formidable Forms 6.5 - 6.35 - Unauthenticated Payment Gateway Connect Verification DoS CVE-2026-85642 7.5 HighOctober 21, 2026
• unknown wpforms lite, wpforms lite +1 more WPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce CVE-2026-82844 5.3 MediumOctober 14, 2026
• made i.t. forms Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission CVE-2026-86799 8.8 HighOctober 14, 2026
• basix nex-forms NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter CVE-2026-106166 5.3 MediumOctober 14, 2026
• brainstorm force sureforms WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability CVE-2026-108495 6.5 MediumOctober 13, 2026
• piotnetdotcom piotnet forms Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload CVE-2026-96227 8.8 HighOctober 11, 2026
• unknown click5 crm add-on to gravity forms click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications CVE-2026-84260 8.8 HighOctober 11, 2026
• unknown click5 crm add-on to wpforms click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications CVE-2026-84259 8.8 HighOctober 11, 2026
• unknown click5 crm add-on to ninja forms click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications CVE-2026-84258 8.8 HighOctober 11, 2026
• unknown click5 crm add-on to gravity forms click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update CVE-2026-84253 9.8 CriticalOctober 11, 2026
• unknown click5 crm add-on to wpforms click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update CVE-2026-84252 9.8 CriticalOctober 11, 2026
• unknown click5 crm add-on to ninja forms click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update CVE-2026-84251 9.8 CriticalOctober 11, 2026
• unknown database addon for wpforms ( wpforms entries ) Database Addon For WPForms < 1.1.1 - Arbitrary Form Entry Deletion via CSRF CVE-2026-105260 4.3 MediumOctober 8, 2026
• edgarrojas smart forms WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability CVE-2026-32574 7.1 HighOctober 6, 2026
• kevin stover ninja forms WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability CVE-2026-102385 7.1 HighSeptember 30, 2026
• happyforms WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability CVE-2026-97065 7.1 HighSeptember 30, 2026
• syed balkhi wpforms WPForms Lite 1.5.0.1 - 2.0.2 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation CVE-2026-84744 6.5 MediumSeptember 28, 2026
• syed balkhi wpforms WPForms Lite 1.8.8.2 - 2.0.1.1 - Unauthenticated Stripe Refund and Subscription Cancellation via External PaymentIntent CVE-2026-74991 6.8 MediumSeptember 24, 2026
• kevin stover ninja forms WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability CVE-2026-95515 7.1 HighSeptember 23, 2026
• unknown forminator forms Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts CVE-2026-87071 5.3 MediumSeptember 23, 2026
• unknown forminator forms Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing CVE-2026-87070 5.3 MediumSeptember 23, 2026
• unknown subscribe forms Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting CVE-2026-91073 6.8 MediumSeptember 23, 2026
• unknown forminator forms Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link CVE-2026-87074 3.7 LowSeptember 23, 2026
• unknown forminator forms Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe CVE-2026-87069 3.1 LowSeptember 23, 2026
• unknown ninja forms Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export CVE-2026-91827 7.5 HighSeptember 22, 2026
• unknown ninja forms Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin CVE-2026-92438 8.8 HighSeptember 22, 2026
• unknown forminator forms Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import CVE-2026-87068 6.6 MediumSeptember 20, 2026
• unknown forminator forms Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection CVE-2026-87067 8.5 HighSeptember 20, 2026
• matthiasnordwig invisible anti-spam & captcha — recaptcha alternative for all forms Invisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion CVE-2026-91010 4.3 MediumSeptember 17, 2026
• unknown formidable forms Formidable Forms < 6.35 - Unauthenticated Arbitrary Shortcode Execution via [entry_key] Custom HTML Token CVE-2026-19857 4.8 MediumSeptember 16, 2026
• unknown formidable forms Formidable Forms 6.34 - Unauthenticated Stored Content Injection via 'updated_by' Parameter CVE-2026-85641 4.3 MediumSeptember 16, 2026
• unknown samo forms SAMO Forms <= 1.0.0 - Unauthenticated SQLi CVE-2026-80491 8.6 HighSeptember 12, 2026
• unknown ninja forms Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution via IP and Referer Merge Tags CVE-2026-80437 4.8 MediumSeptember 6, 2026
• unknown ninja forms Ninja Forms 3.14.0 - 3.15.1 - Authenticated Arbitrary Post Modification and Sensitive Information Disclosure via Abilities REST API CVE-2026-80438 5.9 MediumSeptember 4, 2026
• brainstorm force sureforms WordPress SureForms plugin <= 2.12.5 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-85308 5.3 MediumSeptember 3, 2026
• unknown hipaa forms CM HIPAA Forms < 3.2.0 - Unauthenticated Authorization Bypass CVE-2026-2688 6.5 MediumSeptember 2, 2026
• unknown stripe payment forms by wp full pay Stripe Payment Forms by WP Full Pay < 8.5.5 - Cross-Customer Subscription Cancellation via IDOR CVE-2026-80311 4.3 MediumAugust 29, 2026
• Show olderLoading…