Vulnerabilities
Summary — last 7 days
New vulnerabilities2,751▼ 38 vs. last week
Critical / high1,262▼ 270 vs. last week
New active exploitation (KEV)6▼ 1 vs. last week
Unscored (no CVSS)246▲ 209 vs. last week
9 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | High (7.2) | 0.32% | — | WP Cost Estimation Payment Forms BuilderAI | 7/9/2026 | 7/9/2026 | The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customerInfos' parameter in all versions up to, and including, 10.5.97 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers… | |
| Deferred | High (8.8) | 0.31% | — | Balbooa Joomla Forms BuilderAI | 5/10/2026 | 7/25/2026 | Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler that allows remote attackers to execute arbitrary SQL queries. Attackers can send POST requests to the com_baforms component with malicious JSON payloads in the 'id' field parameter to extract… | |
| Deferred | High (7.5) | 0.38% | — | Loopus WP Cost Estimation AND Payment Forms BuilderAI | 3/25/2026 | 6/17/2026 | Missing Authorization vulnerability in loopus WP Cost Estimation & Payment Forms Builder WP_Estimation_Form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through < 10.3.0. | |
| Deferred | High (8.5) | 0.40% | — | Powerformbuilder Power-forms-builderAI | 12/18/2024 | 6/17/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PowerFormBuilder PowerFormBuilder power-forms-builder allows SQL Injection.This issue affects PowerFormBuilder: from n/a through <= 1.0.6. | |
| Deferred | High (7.1) | 0.35% | — | Loopus WP Cost Estimation AND Payment Forms BuilderAI | 4/17/2024 | 6/17/2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Loopus WP Cost Estimation & Payment Forms Builder allows Reflected XSS.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.75. | |
| Deferred | Medium (6.5) | 0.44% | — | Loopus WP Cost Estimation & Payment Forms BuilderAI | 4/17/2024 | 6/17/2026 | Missing Authorization vulnerability in Loopus WP Cost Estimation & Payment Forms Builder.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.76. | |
| Deferred | High (8.5) | 0.49% | — | Loopus WP Cost Estimation AND Payment Forms BuilderAI | 3/31/2024 | 6/17/2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Cost Estimation & Payment Forms Builder.This issue affects WP Cost Estimation & Payment Forms Builder: from n/a through 10.1.75. | |
| Modified | Medium (6.5) | 0.32% | — | Addify Abandoned Cart RecoveryAddify Advanced Free GiftsAddify Checkout Fields ManagerAddify Custom Fields FOR Woocommerce+6 | 7/31/2023 | 6/17/2026 | The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress plugin before 1.0.4, Custom Order Number WordPress plugin through 1.0.1, Custom Registration Forms Builder WordPress plugin before 1.0.2, Advanced Free Gifts… | |
| Modified | Medium (5.5) | 1.8% | — | Oracle Forms Builder | 7/18/2005 | 6/16/2026 | Oracle Formsbuilder 9.0.4 stores database usernames and passwords in a temporary file, which is not deleted after it is used, which allows local users to obtain sensitive information. |