Plugin icon

Super Forms - Drag & Drop Form Builder

super-forms

Vulnerabilities:

10

Last Updated:

January 27, 2022

Active Installs:

n/a

Published
Title
Fixed in
CVSS
Published
2026-10-07
Title
Super Forms < 6.3.317 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute
Fixed in
Fixed in 6.3.317
CVSS
8.8 (high)
Published
2026-10-07
Title
Super Forms < 6.3.317 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter
Fixed in
Fixed in 6.3.317
CVSS
9.1 (critical)
Published
2026-10-01
Title
Super Forms – Drag & Drop Form Builder < 6.3.317 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login
Fixed in
Fixed in 6.3.317
CVSS
8.8 (high)
Published
2026-10-01
Title
Super Forms < 6.3.317 - Unauthenticated Arbitrary File Read via 'sfgtfi' Parameter
Fixed in
Fixed in 6.3.317
CVSS
8.6 (high)
Published
2026-09-30
Title
Super Forms < 6.3.317 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
Fixed in
Fixed in 6.3.317
CVSS
8.1 (high)
Published
2026-09-30
Title
Super Forms < 6.3.317 - Unauthenticated Privilege Escalation via 'role' Parameter
Fixed in
Fixed in 6.3.317
CVSS
9.8 (critical)
Published
2026-08-24
Title
Super Forms – Drag & Drop Form Builder <= 6.3.315 - Unauthenticated Arbitrary File Read
Fixed in
No known fix
CVSS
7.5 (high)
Published
2026-07-09
Title
Super Forms < 6.3.314 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
Fixed in
Fixed in 6.3.314
CVSS
9.8 (critical)
Published
2022-01-31
Title
Superforms < 6.0.4 - Reflected Cross-Site Scripting
Fixed in
Fixed in 6.0.4
CVSS
4.7 (medium)
Published
2021-01-28
Title
Super Forms < 4.9.703 - Unauthenticated PHP File Upload to RCE
Fixed in
Fixed in 4.9.703
CVSS
9.0 (critical)