Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,915 results · page 7 of 59
Sep 5, 2026Gravity Forms: Stored Cross-Site ScriptingCVE-2026-16649 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time sanitization because wp_kses_post allows the required HTML tags and attributes, and the client-side tooltip script re-parses the browser-decoded aria-label value as innerHTML while only stripping script elements, leaving onerror and other event-handler attributes fully intact and executable.
- Product
- Gravity Forms
- Affected
- up to 2.10.5
- What to do
- Affects up to 2.10.5. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.gravityforms.comwordfence.com
Sep 4, 2026Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied CVE-2026-85624 · Other software · blinkospace · reported by VulnCheckHigh 7.1
Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied note identifiers. Authenticated attackers can enumerate sequential note IDs and retrieve complete content of other users' private notes including attachments and tags.
- Product
- blinko
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2026Ninja Forms: Does not restrict its REST abilities to administratorsCVE-2026-80438 · WordPress plugins & themes · reported by WPScanMedium 5.9
The Ninja Forms WordPress plugin before 3.15.2 does not restrict its REST abilities to administrators, accepting a Ninja Forms WordPress plugin before 3.15.2-specific capability as equivalent to full site administration, which allows any user granted that capability to read Ninja Forms WordPress plugin before 3.15.2 settings and stored form submissions, overwrite the Ninja Forms WordPress plugin before 3.15.2's configuration, and create or modify arbitrary posts and pages. The capability belongs to no default WordPress role and the Ninja Forms WordPress plugin before 3.15.2 never grants it, so an administrator must have assigned it, typically when delegating access to the form builder.
- Product
- Ninja Forms
- Fixed in
- 3.15.2
- What to do
- Update Ninja Forms to 3.15.2 or newer.
Sep 3, 2026MOOS core-moos through 10.4.0 contains a denial of service vulnerability in MOOSCommServer::ListenLoop() where the accept thread performs a blocking receive witCVE-2026-85443 · Other software · themoos · reported by VulnCheckHigh 8.7
MOOS core-moos through 10.4.0 contains a denial of service vulnerability in MOOSCommServer::ListenLoop() where the accept thread performs a blocking receive without timeout during the wire-protocol handshake. An attacker can open a TCP connection to the MOOSDB port and send no data, causing the accept thread to block indefinitely while holding the socket-list lock, preventing all subsequent client connections.
- Product
- core-moos
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026SureForms: Authorization Bypass Through User-Controlled KeyCVE-2026-85308 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SureForms: from n/a through 2.12.5.
- Product
- SureForms
- Affected
- up to 2.12.5
- What to do
- Affects up to 2.12.5. Update SureForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 3, 2026Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.CVE-2026-81773 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
- Affected
- up to 3.3.26
- What to do
- Affects up to 3.3.26. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and anCVE-2026-18329 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 8.8
Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request that triggers an error condition in the access validation logic. This may cause the js_access phase to fail open, allowing the request to proceed instead of being denied, resulting in an authentication or authorization bypass and unauthorized access to protected resources. Impact This vulnerability may allow remote attackers to bypass js_access controls. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- NGINX JavaScript
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026HIPAA FORMS: Contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requestsCVE-2026-2688 · WordPress plugins & themes · reported by WPScanMedium 6.5
The HIPAA FORMS WordPress plugin before 3.2.0 contains a hardcoded authentication bypass via a hardcoded parameter alongside all AJAX requests. The server explicitly checks for this value to skip nonce validation entirely. This allows unauthenticated attackers to access protected AJAX endpoints.
- Product
- HIPAA FORMS
- Fixed in
- 3.2.0
- What to do
- Update HIPAA FORMS to 3.2.0 or newer.
Sep 2, 2026Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.CVE-2026-81772 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions.
- Affected
- up to 3.0.31
- What to do
- Affects up to 3.0.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 2, 2026Advanced Custom Fields: Extended: Does not restrict the role submitted through its front-end user forms to the roles the form actually offersCVE-2026-80467 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator.
- Product
- Advanced Custom Fields: Extended
- Fixed in
- 0.9.2.7
- What to do
- Update Advanced Custom Fields: Extended to 0.9.2.7 or newer.
Sep 2, 2026SigmaForms Pro – AI Generated Forms: Arbitrary file deletionCVE-2026-78657 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_submission_files function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). The malicious path traversal URL is submitted via form upload field and stored in the database, with deletion triggered when an administrator deletes the submission record from the admin panel.
- Product
- SigmaForms Pro – AI Generated Forms
- Affected
- up to 1.4.11
- What to do
- Affects up to 1.4.11. Update SigmaForms Pro – AI Generated Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordfeedback.bdthemes.comwordfence.com
Sep 2, 2026Advanced Custom Fields: Extended: Does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capabilityCVE-2026-12526 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted user account in the update-user action of its front-end Forms module; it only checks a capability when the submitted role is administrator or super_admin. On a site that exposes a publicly reachable front-end form whose user-update action targets an existing administrator (a fixed target, or one mapped to a visitor-submitted field) and maps the password to a visitor-submitted field, an unauthenticated visitor can overwrite that administrator's password and take over the account. The default target is the submitting user, so exploitation depends on the form being configured to target another account.
- Product
- Advanced Custom Fields: Extended
- Fixed in
- 0.9.2.7
- What to do
- Update Advanced Custom Fields: Extended to 0.9.2.7 or newer.
Sep 1, 2026A denial-of-service security issue exists in the affected Logix platforms listed in the table above.CVE-2026-9637 · Other software · Rockwell Automation · reported by PSIRT@rockwellautomation.comHigh 8.7
A denial-of-service security issue exists in the affected Logix platforms listed in the table above. The security issue stems from improper validation of input length during CIP message processing. This can result in a major nonrecoverable fault (MNRF), requiring a power cycle to recover
- Product
- CompactLogix® 5380 / ControlLogix® 5580
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrockwellautomation.com
Sep 1, 2026Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update aCVE-2026-51760 · Other software · reported by MITRECritical 9.8
Incorrect access control in the informSyncUpgfw function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to mass-trigger firmware update activity across mesh slaves via sending a crafted MQTT message to the cs_broker component.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2026Gravity Forms: Arbitrary File UploadCVE-2026-19513 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the `GFAsyncUpload::upload()` function, where public form state URL hashes can be reused as chunk continuation hashes and attacker-controlled temporary filenames are accepted before sanitization. This makes it possible for unauthenticated attackers, when a public form contains a File Upload field with Multiple Files enabled, to upload a valid PNG/PDF polyglot to an attacker-selected public `.php` or `.html` filename in the Gravity Forms temporary upload directory. This can lead to remote code execution on WordPress systems that use NGINX or other non `.htaccess` respecting web servers. NOTE: During installation and activation, the Gravity Forms plugin places a `.htaccess` file in this directory, which prevents this vulnerability from being exploited despite the PHP file being written to the temporary upload directory. In these cases where PHP execution is blocked, attacker-written HTML can result in stored same-origin cross-site scripting if a victim visits the generated file URL.
- Product
- Gravity Forms
- Affected
- up to 3.0.2
- What to do
- Affects up to 3.0.2. Update Gravity Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recorddocs.gravityforms.comwordfence.com
Sep 1, 2026Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns): Generic SQL InjectionCVE-2026-77189 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The [charitable_donors] shortcode is accessible to Contributor-level users via draft or pending post previews, providing an authenticated but low-privileged entry point for exploitation.
- Product
- Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns)
- Affected
- up to 1.8.12.1
- What to do
- Affects up to 1.8.12.1. Update Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 1, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-75964 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload reaches administrators with the manage_options capability when they visit the Users > Unconfirmed Email Addresses list table and interact with row-action links, as the poisoned javascript: href is rendered verbatim into the page HTML by row_actions().
- Product
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 1, 2026User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor: Stored Cross-Site ScriptingCVE-2026-75965 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the wppb_toolbox_shortcodes_settings[format-date] option to be set to 'yes' by an administrator for the shortcode to be active and the vulnerability to be exploitable.
- Product
- User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 31, 2026Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.CVE-2026-81756 · WordPress plugins & themes · reported by PatchstackCritical 9.3
Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.
- Affected
- up to 5.1.24
- What to do
- Affects up to 5.1.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.CVE-2026-81297 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
- Affected
- up to 6.2.12
- What to do
- Affects up to 6.2.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.CVE-2026-81296 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions.
- Affected
- up to 6.2.12
- What to do
- Affects up to 6.2.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 31, 2026Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger mesh slave update coCVE-2026-51734 · Other software · reported by MITRECritical 9.8
Incorrect access control in the informSlaveUpdate function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger mesh slave update coordination via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2026Sigma Forms Pro: Remote Code ExecutionCVE-2026-14494 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation.
- Product
- Sigma Forms Pro
- Affected
- up to 1.4.5
- What to do
- Affects up to 1.4.5. Update Sigma Forms Pro to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordfeedback.bdthemes.comwordfence.com
Aug 29, 2026Stripe Payment Forms by WP Full Pay: Does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling itCVE-2026-80311 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before cancelling it, allowing a user with a confirmed portal session to cancel subscriptions belonging to other customers. Exploitation requires the attacker to know the target subscription's identifier, which is high-entropy and not enumerable through the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5.
- Product
- Stripe Payment Forms by WP Full Pay
- Fixed in
- 8.5.5
- What to do
- Update Stripe Payment Forms by WP Full Pay to 8.5.5 or newer.
Aug 28, 2026Everest Forms: Server-Side Request ForgeryCVE-2026-5096 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.
- Product
- Everest Forms
- Affected
- up to 3.4.4
- What to do
- Affects up to 3.4.4. Update Everest Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 28, 2026CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompreCVE-2026-58107 · Other software · Ericsson · reported by 85b1779b-6ecd-4f52-bcc5-73eac4659dcfMedium 5.5
CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size. An authenticated user with permission to store analysis runs can submit a highly compressed payload that expands to a significantly larger byte sequence. Because the entire decompressed output is materialized in memory before being written to a temporary file, a sufficiently large payload may exhaust process or host memory and consume substantial disk space, resulting in denial of service.
- Product
- CodeChecker
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 28, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-18324 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted Textarea field has the Rich-Text editor option enabled.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.57.0.1
- What to do
- Affects up to 1.57.0.1. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 27, 2026Silverstripe UserForms provides a visual form builder for the Silverstripe CMS.CVE-2026-54721 · Other software · silverstripe · reported by GitHubHigh 8.8
Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1.
- Product
- silverstripe-userforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorizCVE-2026-81686 · Other software · jahlives · reported by VulnCheckMedium 6.9
openssl_encrypt 1.4.x before 1.4.9 contains an optional D-Bus crypto service whose org.freedesktop.DBus.Properties.Set method performs neither a polkit authorization check nor value validation. Any local user on the system bus can call Set without authorization and set MaxConcurrentOperations (to 0/negative, causing the concurrency gate to refuse all subsequent operations, or to a huge value removing the limit) or the unbounded DefaultTimeout, resulting in a persistent denial of service of the root daemon. The D-Bus service exists only on the 1.4.x line and was removed in 1.5.x.
- Product
- openssl_encrypt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Aug 27, 2026Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.CVE-2026-81276 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.
- Affected
- up to 2.4.23
- What to do
- Affects up to 2.4.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 27, 2026In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter.CVE-2026-59355 · Other software · VMware · reported by security@vmware.comMedium 6.1
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.
- Product
- Spring Authorization Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPCVE-2026-80350 · Other software · OneUptime · reported by VulnCheckHigh 7.1
OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside Common/Server/Utils/SSRFProtection.ts, performed by isBlockedHostnameLiteral, rejects private and loopback IPv4 ranges and tests an IPv6 value against the unspecified address, the loopback, the link-local prefix and the unique-local prefixes. A value such as [::ffff:127.0.0.1] matches none of them. The value is also recognised as an address literal rather than a name, so the path that re-checks addresses obtained from resolution is not taken. The HTTP client treats the mapped form as the embedded IPv4 address and connects to it, so an authenticated project member who can configure a webhook can direct the server at loopback services, private network ranges and link-local metadata endpoints, and the response is recorded where the webhook result can be read. Version 12.0.7 adds handling for the mapped range.
- Product
- OneUptime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026StarRocks performs no privilege check when a legacy synchronous materialized view is dropped.CVE-2026-80346 · Other software · StarRocks · reported by VulnCheckHigh 7.1
StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement returns immediately with a comment stating the check happens in execution logic. That holds only for asynchronous materialized views: LocalMetastore.dropMaterializedView calls Authorizer.checkMaterializedViewAction inside a branch taken when the resolved table is a MaterializedView. A legacy synchronous materialized view is stored as a rollup index on an OlapTable rather than a MaterializedView, so the other branch runs, reaching AlterJobMgr.processDropMaterializedView and MaterializedViewHandler, neither of which contains any Authorizer call. The former locates the target by scanning every OlapTable in the named database for a matching rollup index, and the latter validates only table state and name conflicts. Any authenticated account can therefore drop a legacy synchronous materialized view belonging to any database, holding no grant on the view, the base table or the database, and the drop is indistinguishable from an authorized one.
- Product
- StarRocks
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2026Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More: Stored Cross-Site ScriptingCVE-2026-18331 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_id' parameter in all versions up to, and including, 6.33.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. By forging frm_user_id to match an administrator's user ID — discoverable via the public WordPress REST API — an unauthenticated attacker causes wp_kses_post() to serve as the only output filter, which preserves the injected payload structurally intact; the plugin's admin JavaScript then decodes and executes it automatically on page load.
- Product
- Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More
- Affected
- up to 6.33.1
- What to do
- Affects up to 6.33.1. Update Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 26, 2026Stripe Payment Forms by WP Full Pay: Does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on itCVE-2026-77789 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions belonging to other customers.
- Product
- Stripe Payment Forms by WP Full Pay
- Fixed in
- 8.5.1
- What to do
- Update Stripe Payment Forms by WP Full Pay to 8.5.1 or newer.
Aug 26, 2026Stripe Payment Forms by WP Full Pay: Does not properly verify that a customer portal session has completed its confirmation step before returning dataCVE-2026-77758 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not properly verify that a customer portal session has completed its confirmation step before returning data, allowing unauthenticated users to read another customer's subscription and billing information.
- Product
- Stripe Payment Forms by WP Full Pay
- Fixed in
- 8.5.1
- What to do
- Update Stripe Payment Forms by WP Full Pay to 8.5.1 or newer.
Aug 26, 2026Forminator Forms: Does not verify that site registration is enabled on the network before creating a site signupCVE-2026-19220 · WordPress plugins & themes · reported by WPScanLow 3.7
The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it.
- Product
- Forminator Forms
- Fixed in
- 1.57.1
- What to do
- Update Forminator Forms to 1.57.1 or newer.
Aug 25, 2026Observable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page.CVE-2026-79287 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 5.3
Observable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page.CVE-2026-79133 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 6.5
Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comissues.chromium.org
Aug 25, 2026NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection.CVE-2026-65091 · Other software · NVIDIA · reported by psirt@nvidia.comHigh 8.8
NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.
- Product
- OpenShell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnvd.nist.gov
Aug 25, 2026SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to HiveCVE-2026-49845 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.8
SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadata cache operations) via crafted partition names in metastore RPC requests when direct SQL is enabled (the default). Users are recommended to upgrade to version 4.2.1, which fixes this issue. Details about the issue: Several Hive Metastore RPCs resolve partitions by full partition name (PART_NAME) through direct-SQL helpers. In those paths, client-supplied partition names are embedded into SQL using string concatenation (DirectSqlUpdatePart.quoteString() → '...') instead of bind parameters. A partition name containing a single quote (and crafted SQL) can alter the generated WHERE clause so that lookups intended for one partition match additional rows. That can affect reads, stats updates, truncate targets, metadata-cache targets, and related operations when metastore.try.direct.sql is enabled (default: true). An authenticated or network-trusted caller with the ability to invoke Hive Meta
- Product
- Apache Hive
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownersCVE-2026-77141 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 8.8
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.
- Product
- Extension "Club Directory"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026The extension fails to properly sanitize user input before using it in a database query.CVE-2026-77137 · Other software · TYPO3 · reported by f4fb688c-4412-4426-b4b8-421ecf27b14aHigh 7.7
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module.
- Product
- Extension "Forms Export"
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: DOM-Based Reflected Cross-Site ScriptingCVE-2026-18328 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only triggerable on pages hosting a Forminator form configured to use the Stripe Checkout Sessions payment API, which became the default in 1.56.0.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.57.0
- What to do
- Affects up to 1.57.0. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 25, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-18323 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the Save-and-Continue draft submission AJAX endpoint is registered as nopriv, allowing unauthenticated attackers to bypass radio field option-membership validation and persist a crafted payload that, when rendered on the Submissions admin page, is auto-executed via the bundled Inputmask library's data-attribute callback binding.
- Product
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Affected
- up to 1.57.0.2
- What to do
- Affects up to 1.57.0.2. Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 24, 2026A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web scCVE-2022-30983 · Other software · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web script or HTML via the Enter email parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Aug 24, 2026Super Forms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-28167 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path Traversal.This issue affects Super Forms: from n/a through 6.3.316.
- Product
- Super Forms
- Affected
- up to 6.3.316
- What to do
- Affects up to 6.3.316. Update Super Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Aug 24, 2026Heptabase developed by Hepta Platforms, Inc.CVE-2026-78213 · Other software · Hepta Platforms · reported by twcert@cert.org.twMedium 6.2
Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content.
- Product
- Heptabase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
Aug 22, 2026Forminator Forms: Does not consistently enforce the role restriction it applies to registration formsCVE-2026-19222 · WordPress plugins & themes · reported by WPScanMedium 6.6
The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it.
- Product
- Forminator Forms
- Fixed in
- 1.57.0.7
- What to do
- Update Forminator Forms to 1.57.0.7 or newer.
Aug 22, 2026Forminator Forms: Does not restrict a network-wide setting to network administratorsCVE-2026-19221 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
- Product
- Forminator Forms
- Fixed in
- 1.57.0.5
- What to do
- Update Forminator Forms to 1.57.0.5 or newer.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.