Critical
CVE-2026-84434
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 40
Reset filters
High
CVE-2026-16649
Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value
High
CVE-2026-19513
Gravity Forms <= 3.0.2 - Unauthenticated Arbitrary File Upload via State/Chunk Hash Confusion
High
CVE-2026-12997
Gravity Forms <= 2.10.4 - Unauthenticated Arbitrary File Read via 'gform_uploaded_files' Parameter
Critical
CVE-2026-48866
Gravity Forms <= 2.10.0.1 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-5110
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater
High
CVE-2026-5111
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Hidden Product Field in Repeater
High
CVE-2026-5109
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Product Option
High
CVE-2026-5112
Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Calculation Product Field in Repeater
High
CVE-2026-5113
Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input
Medium
CVE-2026-4394
Gravity Forms <= 2.9.30 - Unauthenticated Stored Cross-Site Scripting via Credit Card 'Card Type' Sub-Field
Medium
CVE-2026-4406
Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter
Medium
CVE-2026-3492
Gravity Forms <= 2.9.28.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Form Title
Critical
CVE-2025-13407
Gravity Forms <= 2.9.23.0 - Unauthenticated Arbitrary File Upload
High
CVE-2025-12974
Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload
Critical
CVE-2025-12352
Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'
Medium
CVE-2024-13845
Gravity Forms WebHooks <= 1.6.0 - Authenticated (Admin+) Server-Side Request Forgery via Webhook
Medium
CVE-2024-13378
GravityForms 2.9.0.1 - 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'style_settings' parameter
High
CVE-2024-13377
GravityForms <= 2.9.1.3 - Unauthenticated Stored Cross-Site Scripting via 'alt' parameter
Medium
CVE-2025-22347
BSK Forms Blacklist <= 3.9 - Cross-Site Request Forgery
Medium
CVE-2024-47624
BSK Forms Blacklist <= 3.8.1 - Reflected Cross-Site Scripting
Medium
CVE-2024-43331
WP SMS <= 6.9.3 - Missing Authorization
Medium
CVE-2024-43233
BSK Forms Blacklist <= 3.8 - Reflected Cross-Site Scripting
Medium
CVE-2024-34811
WP SMS <= 6.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.