WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
form-maker
Published
2026-02-02
Title
Form Maker by 10Web < 1.15.36 - Unauthenticated Stored Cross-Site Scripting via SVG file
Slug
form-maker
Published
2026-02-02
Title
Form Maker by 10Web < 1.15.36 - Unauthenticated Stored Cross-Site Scripting via Hidden Field
Slug
form-maker
Published
2026-03-23
Title
Form Maker < 1.15.38 - SQL Injection
Slug
form-maker
Published
2026-04-13
Title
Form Maker by 10Web < 1.15.41 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box
Slug
form-maker
Published
2026-04-08
Title
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.39 - Unauthenticated SQL Injection
Slug
form-maker
Published
2026-04-16
Title
Form Maker by 10Web < 1.15.41 - Authenticated (Administrator+) SQL Injection via 'ip_search' Parameter
Slug
form-maker
Published
2026-05-04
Title
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder < 1.15.43 - Unauthenticated SQL Injection via 'inputs'
Slug
form-maker
Published
2026-06-17
Title
Form Maker by 10Web < 1.15.44 - Authenticated (Administrator+) SQL Injection via 'name' Parameter
Slug
form-maker
Published
2026-06-17
Title
Form Maker by 10Web < 1.15.44 - Authenticated (Adminsitrator+) SQL Injection via 'groupids' Parameter
Slug
form-maker
Published
2026-08-10
Title
Form Maker by 10Web < 1.15.45 - Subscriber+ SQL Injection via display_name
Slug
form-maker
Published
2026-08-14
Title
Form Maker by 10Web < 1.15.45 - Authenticated (Subscriber+) SQL Injection via '{username}' Placeholder in Dynamic-Choice Field WHERE Clause
Slug
form-maker
Published
2026-08-19
Title
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Unauthenticated Stored Cross-Site Scripting
Slug
form-notify
Published
2026-05-14
Title
Receive Notifications After Form Submitting – Form Notify for Any Forms < 1.1.11 - Unauthenticated Authentication Bypass via LINE OAuth Callback
Slug
form-to-chat
Published
2024-04-05
Title
Form to Chat App < 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
form-to-chat
Published
2026-01-04
Title
Form to Chat App <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
form-to-json
Published
2025-01-16
Title
Form To JSON <= 1.0 - Reflected Cross-Site Scripting
Slug
form-to-sheet
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
form-to-sheet
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
form-vibes
Published
2022-02-28
Title
Unauthorised AJAX Calls via Freemius
Slug
form-vibes
Published
2022-11-08
Title
Form Vibes < 1.4.6 - Admin+ SQLi
Slug
form-vibes
Published
2023-07-18
Title
Freemius SDK < 2.5.10 - Reflected Cross-Site Scripting
Slug
form-vibes
Published
2024-07-11
Title
Form Vibes < 1.4.11 - Authenticated (Subscriber+) SQL Injection via fv_export_data
Slug
form-vibes
Published
2024-09-04
Title
Form Vibes – Database Manager for Forms < 1.4.13 - Missing Authorization in Multiple Functions
Slug
form-vibes
Published
2026-01-05
Title
Form Vibes – Database Manager for Forms < 1.5 - Authenticated (Admin+) SQL Injection
Slug
form-vibes
Published
2026-07-10
Title
Form Vibes < 1.5.3 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field