WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
forminator
Published
2026-10-02
Title
Forminator Forms < 1.57.3 - Unauthenticated Missing Authorization
Slug
forminator
Published
2026-10-08
Title
Forminator < 1.58.0 - Cross-Site Request Forgery
Slug
forminator
Published
2026-10-08
Title
Forminator Forms < 1.58.0 - Unauthenticated Stored XSS
Slug
forminator
Published
2026-10-08
Title
Forminator Forms < 1.58.0 - Unauthenticated Missing Authorization
Slug
forminator
Published
2026-09-30
Title
Forminator Forms < 1.57.2.1 - Unauthenticated Stored XSS via Rich-Text Textarea Field
Slug
forminator
Published
2026-09-30
Title
Forminator Forms < 1.57.2.1 - Unauthenticated Stored XSS via 'postdata-1[post-custom]' Parameter
Slug
forminator
Published
2026-10-12
Title
Forminator Forms < 1.58.1 - Unauthenticated Missing Authorization
Slug
forminator
Published
2026-10-08
Title
Forminator Forms < 1.58.0 - Unauthenticated Privilege Escalation
Slug
forminator
Published
2026-10-02
Title
Forminator Forms < 1.57.2.1 - Unauthenticated Payment Bypass
Slug
forminator
Published
2026-10-29
Title
Forminator Forms < 1.55.1 - Unauthenticated Limited File Deletion via Draft Upload Metadata
Slug
forminator
Published
2026-10-15
Title
Forminator Forms < 1.58.2 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags
Slug
forminator
Published
2026-10-15
Title
Forminator Forms < 1.58.2 - Unauthenticated Arbitrary Shortcode Execution via 's' Parameter and Anonymous Comment
Slug
forminator
Published
2026-10-30
Title
Forminator Forms < 1.58.0 - Unauthenticated Draft Deletion and Takeover via IDOR in 'previous_draft_id' Parameter
Slug
formlayer
Published
2026-07-05
Title
FormLayer < 1.0.7 - Unauthenticated Information Exposure
Slug
formlayer
Published
2026-08-31
Title
FormLayer < 1.0.9 - Unauthenticated Form Configuration Disclosure via Form Submission Response
Slug
formlift
Published
2024-07-19
Title
FormLift for Infusionsoft Web Forms < 7.5.18 - Unauthenticated SQL Injection
Slug
formlift
Published
2025-03-28
Title
FormLift for Infusionsoft Web Forms < 7.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
formlift
Published
2025-06-18
Title
FormLift for Infusionsoft Web Forms < 7.5.21 - Reflected Cross-Site Scripting
Slug
formlift
Published
2026-03-25
Title
FormLift for Infusionsoft Web Forms < 7.5.22 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow
Slug
forms-3rdparty-post-again
Published
2024-11-04
Title
Forms: 3rd-Party Post Again <= 0.3 - Reflected Cross-Site Scripting
Slug
forms-ada-form-builder
Published
2023-04-24
Title
Forms Ada <= 1.0 - Unauthenticated Reflected XSS
Slug
forms-bridge
Published
2026-01-27
Title
Forms Bridge < 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Slug
forms-by-made-it
Published
2021-07-03
Title
Forms < 1.12.3 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
forms-by-made-it
Published
2024-11-08
Title
Forms < 2.8.1 - Unauthenticated Arbitrary File Upload
Slug
forms-by-made-it
Published
2025-08-13
Title
Forms < 3.0.0 - Authenticated (Contributor+) Arbitrary File Upload