Skip to content
OpenAdvisories

Vendor

FormCraft

3 known vulnerabilities.

Products

FormCraft 3
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.2
    CVE-2026-7232

    FormCraft <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Sub-Parameters

    The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenti…

    FormCraft FormCraft Web / CMS
  • High 7.2
    CVE-2025-0817

    FormCraft - Premium WordPress Form Builder <= 3.9.11 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload

    The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.9.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers …

    FormCraft FormCraft Web / CMS