4.3
Medium
CVE-2026-105974 The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent…
Description
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Visual Form Builder 3.1 | earliest → 3.1 | No fix stated |
Other CVEs of Visual Form Builder
The 7 CVEs of Visual Form Builder →
CVE-2026-105973
The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form…
4.3
Medium
CVE-2022-1046
The Visual Form Builder WordPress plugin before 3.0.7 does not sanitise and escape the form's 'Email to' field , which…
Not rated
CVE-2022-0142
The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or…
Not rated
CVE-2022-0141
The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to…
Not rated