Skip to contentUnknown Forms vulnerabilities
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.1 - Cross-Customer Subscription Modification via IDORCVE-2026-777894.3 Medium
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.1 - Unauthenticated Customer Portal Subscription and Billing Data Disclosure via Unconfirmed SessionCVE-2026-777585.3 Medium
- unknown forminator formsForminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege EscalationCVE-2026-192203.7 Low
- unknown forminator formsForminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role BypassCVE-2026-192226.6 Medium
- unknown forminator formsForminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on MultisiteCVE-2026-192217.2 High
- sureformsSureForms contains an uncontrolled resource consumption vulnerabilityCVE-2026-19500Public exploit7.5 High
- sureformsCVE-2026-19501CVE-2026-19501Public exploit8.8 High
- unknown login & register formsLogin & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password ResponseCVE-2026-18470Public exploit7.5 High
- unknown login & register formsLogin & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute ForceCVE-2026-184698.1 High
- unknown login & register formsLogin & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address HeaderCVE-2026-184688.1 High
- unknown ninja formsNinja Forms < 3.14.10 - Unauthenticated Arbitrary Shortcode Execution via Query-String Populated Field DefaultCVE-2026-152564.8 Medium
- unknown formidable formsFormidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription StatusCVE-2026-113615.9 Medium
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount ManipulationCVE-2026-167347.5 High
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.5 - Authenticated SQL Injection via id ParameterCVE-2026-148726.8 Medium
- unknown login & register formsLogin/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit BypassCVE-2026-148368.1 High
- unknown fluent formsFluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time FieldCVE-2026-118816.1 Medium
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_idCVE-2026-148707.1 High
- nasirahmed advanced form integration — connect forms to 200+ appsAdvanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() FunctionCVE-2026-165874.3 Medium
- saturday drive ninja formsNinja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio FieldsCVE-2026-650528.7 High
- saturday drive ninja formsNinja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission HandlerCVE-2026-650516.9 Medium
- saturday drive ninja formsNinja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated VisitorsCVE-2026-650507.1 High
- saturday drive ninja formsNinja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX ActionCVE-2026-650498.4 High
- saturday drive ninja formsNinja Forms Unauthenticated Stored Cross-Site Scripting via Repeatable Fieldset Submission IndexCVE-2026-650489.3 Critical
- basix nex-formsNEX-Forms < 9.2.3 - Unauthenticated Stored XSS via Form SubmissionCVE-2026-105256.1 Medium
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.17 - Contributor+ Arbitrary Post Metadata Disclosure via IDORCVE-2026-115805.5 Medium
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.17 - Unauthenticated Media UploadCVE-2026-115795.3 Medium
- unknown sureformsSureForms < 2.11.1 - Unauthenticated Payment Amount BypassCVE-2026-115675.9 Medium
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms < 1.5.2 - Unauthenticated PHP Object Injection via Entry File FieldCVE-2026-120815.0 Medium
- unknown everest formsEverest Forms < 3.5.0 - Unauthenticated Missing Authorization via Site Assistant REST EndpointsCVE-2026-122706.5 Medium
- unknown everest formsEverest Forms < 3.5.0 - Unauthenticated Sensitive Information Exposure via Residual CSV ArtifactsCVE-2026-115717.5 High
- unknown notifications for forms & wordpress actionsWANotifier < 2.6 - Subscriber+ LFICVE-2024-62287.5 High
- unknown fluent formsFluent Forms < 6.2.5 - Form Manager+ Cross-Form Submission Entry Deletion via IDORCVE-2026-115782.7 Low
- unknown fluent formsFluent Forms < 6.2.1 - Subscriber+ Subscription Cancellation via IDORCVE-2026-118803.1 Low
- unknown advanced form integration — connect forms to 200+ appsAdvanced Form Integration < 2.1.1 - Unauthenticated Privilege Escalation via Breakdance Form Role MappingCVE-2026-117948.1 High
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field CaptionCVE-2026-115815.9 Medium
- happyformsWordPress Happyforms plugin <= 1.26.13 - PHP Object Injection vulnerabilityCVE-2026-497689.8 Critical
- syed balkhi wpformsWPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook ForgeryCVE-2026-49865.3 Medium
- unknown gutena formsGutena Forms < 1.6.1 - Contributor+ Arbitrary Limited Options UpdateCVE-2026-17536.8 Medium
- basix nex-formsNex-Forms Express WP Form Builder < 9.1.8 - Authenticated Stored XSSCVE-2025-148036.8 Medium
- ninjaforms ninja formsNinja Forms < 3.13.3 - Unauthenticated Token Generation and Submission DisclosureCVE-2025-140725.3 Medium
- gravity forms forms, unknown gravity forms +1 moreGravityForms < 2.9.23.1 - Unauthenticated Arbitrary File UploadCVE-2025-134076.8 Medium
- unknown doppler formsDoppler Forms <= 2.5.1 - Subscriber+ Limited Plugin InstallationCVE-2025-95446.5 Medium
- unknown sureformsSureForms < 1.9.1 - Admin+ Stored XSSCVE-2025-82823.5 Low
- ninjaforms ninja formsNinja-forms < 3.11.1 - Unauthenticated PHP ObjectionCVE-2025-90839.8 Critical
- brainstormforce sureformsSureForms < 1.7.2 - Reflected XSSCVE-2025-59215.8 Medium
- ninjaforms ninja formsNinja Forms < 3.10.1 - Admin+ Stored XSSCVE-2025-25614.8 Medium
- ninjaforms ninja formsNinja Forms < 3.10.1 - Admin+ Stored XSSCVE-2025-25604.8 Medium
- ninjaforms ninja formsNinja Forms < 3.10.1 - Admin+ Stored XSSCVE-2025-25244.8 Medium
- unknown everest formsEverest Forms < 3.0.3.1 - Admin+ Stored XSSCVE-2024-85424.8 Medium
- happyformsHappyforms < 1.26.3 - Admin+ Stored XSSCVE-2024-100544.8 Medium
- Show moreLoading…