Skip to content
Noroxi

Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent

tablesome · plugin

Known security vulnerabilities for Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent. Find out in seconds which version runs on your site with WP Lens.

10 known vulnerabilities

2 critical · 5 exploitable without logging in · latest Aug 12, 2026

Listed on wordpress.org · latest 1.2.14 · last updated Sep 28, 2026 · 7K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2025-11499unauthenticated≤ 1.1.32

    Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload

    Critical 9.8

  • CVE-2026-66659unauthenticated≤ 1.2.9

    WordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability

    Critical 9.3

  • CVE-2026-27373login required≤ 1.2.3

    WordPress Tablesome plugin <= 1.2.3 - SQL Injection vulnerability

    High 8.5

  • CVE-2024-29110unauthenticated · needs a click≤ 1.0.27

    WordPress Tablesome plugin <= 1.0.27 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2025-68517login required≤ 1.1.35.1

    WordPress Tablesome plugin <= 1.1.35.1 - Broken Access Control vulnerability

    Medium 5.4

  • CVE-2024-37498unauthenticated≤ 1.0.33

    WordPress Tablesome plugin <= 1.0.33 - Sensitive Data Exposure via API vulnerability

    Medium 5.3

  • CVE-2025-68516login required≤ 1.1.35.1

    WordPress Tablesome plugin <= 1.1.35.1 - Sensitive Data Exposure vulnerability

    Medium 5.0

  • CVE-2024-31388unauthenticated · needs a click≤ 1.0.25

    WordPress Tablesome plugin <= 1.0.25 - Cross Site Request Forgery (CSRF) vulnerability

    Medium 4.3

  • CVE-2026-24524login required≤ 1.2.8

    WordPress Tablesome plugin <= 1.2.8 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2025-66526login required≤ 1.1.34

    WordPress Tablesome plugin <= 1.1.34 - Broken Access Control vulnerability

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory