Skip to content
Noroxi

incsub records

27 published records for vendor incsub.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
2
With a fix record
22.2%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 23
  6. 24
  7. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

27 records
  • CVE-2023-4596
    43Plan

    Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    incsub · forminatorAug 29, 2023

  • CVE-2025-6463
    39Monitor

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submiss

    HighCVSS 8.8No exploitEPSS 13%

    incsub · forminatorJul 2, 2025

  • CVE-2023-1478
    39Monitor

    Hummingbird < 3.4.2 - Unauthenticated Path Traversal

    CriticalCVSS 9.8No exploitEPSS 1%

    incsub · hummingbirdApr 10, 2023

  • CVE-2024-31077
    37Monitor

    Forminator prior to 1.29.3 contains a SQL injection vulnerability.

    HighCVSS 7.2No exploitEPSS 30%

    incsub · forminatorApr 23, 2024

  • CVE-2019-11872
    36Monitor

    The Hustle (aka wordpress-popup) plugin 6.0.7 for WordPress is vulnerable to CSV Injection as it allows for injecting malicious code into a

    HighCVSS 8.8No exploitEPSS 2%

    incsub · hustleMay 29, 2019

  • CVE-2024-43118
    35Monitor

    WordPress Hummingbird plugin <= 3.9.1 - Broken Access Control vulnerability

    HighCVSS 8.8No exploitEPSS 1%

    incsub · hummingbirdNov 1, 2024

  • CVE-2025-6464
    35Monitor

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Sub

    HighCVSS 8.8No exploitEPSS 1%

    incsub · forminatorJul 2, 2025

  • CVE-2015-9455
    32Monitor

    The buddypress-activity-plus plugin before 1.6.2 for WordPress has CSRF with resultant directory traversal via the wp-admin/admin-ajax.php b

    HighCVSS 8.1No exploitEPSS 1%

    incsub · buddypress-activity-plusOct 7, 2019

  • CVE-2024-7389
    30Monitor

    Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

    HighCVSS 7.5No exploitEPSS 1%

    incsub · forminatorAug 2, 2024

  • CVE-2019-9568
    26Monitor

    The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=formina

    MediumCVSS 6.5No exploitEPSS 2%

    incsub · forminatorMar 4, 2019

  • CVE-2023-3134
    25Monitor

    Forminator < 1.24.4 - Reflected XSS

    MediumCVSS 6.1No exploitEPSS 4%

    incsub · forminatorJul 31, 2023

  • CVE-2019-9567
    24Monitor

    The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.

    MediumCVSS 6.1No exploitEPSS 1%

    incsub · forminatorMar 4, 2019

  • CVE-2024-1794
    24Monitor

    Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload

    MediumCVSS 6.1No exploitEPSS 1%

    incsub · forminatorApr 9, 2024

  • CVE-2024-45625
    24Monitor

    Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1.

    MediumCVSS 6.1No exploitEPSS 0%

    incsub · forminatorSep 9, 2024

  • CVE-2024-29777
    24Monitor

    WordPress Forminator plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability

    MediumCVSS 6.1No exploitEPSS 0%

    incsub · forminatorMar 27, 2024

  • CVE-2021-36821
    24Monitor

    WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability

    MediumCVSS 6.1No exploitEPSS 0%

    incsub · forminatorMar 16, 2023

  • CVE-2018-18576
    21Monitor

    The Hustle (aka wordpress-popup) plugin through 6.0.5 for WordPress allows Directory Traversal to obtain a directory listing via the views/a

    MediumCVSS 5.3No exploitEPSS 1%

    incsub · hustleMar 17, 2020

  • CVE-2024-28890
    21Monitor

    Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability.

    MediumCVSS 5.3No exploitEPSS 1%

    incsub · forminatorApr 23, 2024

  • CVE-2024-31857
    21Monitor

    Forminator prior to 1.15.4 contains a cross-site scripting vulnerability.

    MediumCVSS 5.4No exploitEPSS 1%

    incsub · forminatorApr 23, 2024

  • CVE-2024-3053
    21Monitor

    Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode

    MediumCVSS 5.4No exploitEPSS 0%

    incsub · forminatorApr 9, 2024

  • CVE-2024-32792
    21Monitor

    WordPress Hummingbird plugin <= 3.7.3 - Broken Access Control vulnerability

    MediumCVSS 5.3No exploitEPSS 0%

    incsub · hummingbirdJun 9, 2024

  • CVE-2022-0994
    20Monitor

    Hummingbird < 3.3.2 - Admin+ Stored Cross-Site Scripting

    MediumCVSS 4.8No exploitEPSS 3%

    incsub · hummingbirdApr 18, 2022

  • CVE-2023-6133
    19Monitor

    Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload

    MediumCVSS 4.9No exploitEPSS 1%

    incsub · forminatorNov 15, 2023

  • CVE-2021-24700
    19Monitor

    Forminator < 1.15.4 - Admin+ Stored Cross-Site Scripting

    MediumCVSS 4.8No exploitEPSS 1%

    incsub · forminatorNov 23, 2021

  • CVE-2023-5119
    19Monitor

    Forminator and Forminator Pro < 1.27.0 - Admin+ Stored Cross-Site Scripting

    MediumCVSS 4.8No exploitEPSS 0%

    incsub · forminatorNov 20, 2023