Medium
CVE-2026-19857
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 53
Reset filters
Medium
CVE-2026-85641
Formidable Forms <= 6.34 - Unauthenticated Content Injection
High
CVE-2026-15990
Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter
High
CVE-2026-18331
Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter
Critical
CVE-2026-16230
Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field
Medium
CVE-2026-65523
Formidable Forms Signature Online Contract Automation <= 2.0.1 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-11361
Formidable Forms <= 6.32.0 - Unauthenticated Payment Bypass
High
CVE-2026-49105
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 - Unauthenticated PHP Object Injection
High
CVE-2026-49085
WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 - Unauthenticated PHP Object Injection
High
CVE-2026-49104
Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 - Unauthenticated PHP Object Injection
High
CVE-2026-49109
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 - Unauthenticated PHP Object Injection
Medium
CVE-2026-8871
Formidable Kinetic <= 1.1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-32527
WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Missing Authorization
Medium
CVE-2026-2888
Formidable Forms <= 6.28 - Unauthenticated Payment Amount Manipulation via 'item_meta' Parameter
High
CVE-2026-2890
Formidable Forms <= 6.28 - Missing Authorization to Unauthenticated Payment Integrity Bypass via PaymentIntent Reuse
High
CVE-2026-2568
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-67468
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.6 - Missing Authorization
Critical
CVE-2025-49330
Integration for Contact Form 7 and Zoho CRM, Bigin <= 1.3.0 - Unauthenticated PHP Object Injection
Medium
CVE-2025-4659
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.4 - Unauthenticated Full Path Disclosure
Medium
CVE-2025-32581
WordPress Spam Blocker <= 2.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-32269
WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.3 - Cross-Site Request Forgery
Medium
CVE-2025-24708
WP Dynamics CRM for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.6 - Reflected Cross-Site Scripting
Medium
CVE-2024-11188
Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter
Medium
CVE-2024-52347
Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.