Priority MEDIUM 45
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 6.3.316 via the submit_form function.
Vulnerabilities
8 records
Priority MEDIUM 41
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and including, 6.3.316 via the upload_files function.
TI-2026-65790 CVE-2026-15896 · GHSA-r39q-9952-j46j
Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter
Priority MEDIUM 47
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function.
TI-2026-65791 CVE-2026-15897 · GHSA-h8h9-7p7r-7rpq
Improper privilege management in WebRehab Super Forms – Drag & Drop Form Builder
Priority MEDIUM 40
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316.
TI-2026-13385 CVE-2026-15983 · GHSA-5vqm-vx23-85p5
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
Priority LOW 36
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, and including, 6.3.316.
TI-2026-13389 CVE-2026-15989 · GHSA-mjx4-cmxj-rrrw
Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
Priority MEDIUM 49
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.316.
TI-2026-22507 CVE-2026-28167 · GHSA-2r89-pxpw-mwf2
WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability
Priority LOW 39
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path Traversal.This issue affects Super Forms: from n/a through 6.3.316.
TI-2026-12550 CVE-2026-14894 · GHSA-f5f5-22mx-8h54
Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)
Priority MEDIUM 55
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function.