Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 58

Reset filters

Medium 09.10.2026

CVE-2026-104728

AutomatorWP <= 5.8.4 - Missing Authorization to Sensitive Information Disclosure

A missing authorization check in AutomatorWP allows authenticated users with subscriber or higher permissions to view Fluent Forms records, exposing form IDs and titles.

Medium 09.10.2026

CVE-2026-15178

Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification

Medium 09.10.2026

CVE-2026-101324

Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter

Medium 05.10.2026

CVE-2026-94669

Fluent Forms Pro Add On Pack <= 6.2.13 - Missing Authorization

High 05.10.2026

CVE-2026-94675

Fluent Forms Pro Add On Pack <= 6.2.13 - Unauthenticated Stored Cross-Site Scripting

Medium 01.10.2026

CVE-2026-103343

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting

Medium 01.10.2026

CVE-2026-103353

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder <= 6.2.14 - Missing Authorization

Medium 28.08.2026

CVE-2026-81297

Fluent Forms Pro Add On Pack <= 6.2.12 - Authenticated (Subscriber+) Privilege Escalation

Medium 28.08.2026

CVE-2026-81296

Fluent Forms Pro Add On Pack <= 6.2.12 - Missing Authorization

High 18.08.2026

CVE-2026-66633

Fluent Forms Pro Add On Pack < 6.2.12 - Unauthenticated Stored Cross-Site Scripting

High 12.08.2026

CVE-2026-18146

Fluent Forms <= 6.2.11 - Unauthenticated Stored Cross-Site Scripting via Notification Smartcode Values

Medium 11.08.2026

CVE-2026-11578

Fluent Forms <= 6.2.4 - Insecure Direct Object Reference to Authenticated (Form Manager+) Cross-Form Submission Entry Deletion

Medium 10.08.2026

CVE-2026-11880

Fluent Forms <= 6.2.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Subscription Cancellation

Critical 03.08.2026

CVE-2026-73532

Fluent Forms Pro 6.2.7 & Ninja Tables Pro 5.2.13 - Remote Code Execution via Backdoor

Medium 31.07.2026

CVE-2026-17571

Fluent Forms <= 6.2.8 - Reflected Cross-Site Scripting via 'param'

Medium 30.07.2026

CVE-2026-17567

Fluent Forms <= 6.2.8 - Unauthenticated Sensitive Information Exposure via Insecure Direct Object Reference and Weak Transaction Hash in 'transaction' Parameter

Medium 30.07.2026

CVE-2026-11881

Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder < 6.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

High 28.07.2026

CVE-2026-16655

Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member

High 25.07.2026

CVE-2026-15962

Fluent Forms Pro Add On Pack <= 6.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary User Password Change via User Meta Field

Medium 09.07.2026

CVE-2026-5069

Fluent Forms <= 6.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Subscription Cancellation via 'subscription_id'

High 13.05.2026

CVE-2026-5395

Fluent Forms <= 6.2.0 - Authenticated (Subscriber+) Authorization Bypass via 'table' Parameter

High 13.05.2026

CVE-2026-5396

Fluent Forms <= 6.1.21 - Authenticated (Subscriber+) Authorization Bypass via 'form_id' Parameter

Medium 12.05.2026

CVE-2026-6828

Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute

Medium 05.05.2026

CVE-2026-6344

Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment

Showing 1 to 24 of 58 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 58

Know which vulnerabilities affect your application

Application security in your inbox