https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 22:01:00 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-343905 EUVD-2026-343905 https://cve.radiocsirt.org/vuln/euvd-2026-343905 https://cve.radiocsirt.org/vuln/fkie_cve-2026-16144 <p>The Kali Forms — Contact Form &amp; Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the &#39;thisPermalink&#39; field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys (&#39;thisPermalink&#39;, &#39;entryCounter&#39;, or &#39;submission_link&#39;), as check_if_placeholders_changed() only processes POST keys present in the form&#39;s field_type_map.</p> <p>The Kali Forms — Contact Form &amp; Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the &#39;thisPermalink&#39; field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys (&#39;thisPermalink&#39;, &#39;entryCounter&#39;, or &#39;submission_link&#39;), as check_if_placeholders_changed() only processes POST keys present in the form&#39;s field_type_map.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-16144 https://cve.radiocsirt.org/vuln/ghsa-w9gv-h9qh-63cm <p>The Kali Forms — Contact Form &amp; Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the &#39;thisPermalink&#39; field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys (&#39;thisPermalink&#39;, &#39;entryCounter&#39;, or &#39;submission_link&#39;), as check_if_placeholders_changed() only processes POST keys present in the form&#39;s field_type_map.</p> <p>The Kali Forms — Contact Form &amp; Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.20 via the _save_data function. This is due to insufficient validation of the &#39;thisPermalink&#39; field value before it overwrites a trusted callable placeholder, allowing attacker-controlled strings to reach call_user_func() in _save_data(). This makes it possible for unauthenticated attackers to execute code on the server. Exploitation requires the target form to define a field with a name matching one of the reserved placeholder keys (&#39;thisPermalink&#39;, &#39;entryCounter&#39;, or &#39;submission_link&#39;), as check_if_placeholders_changed() only processes POST keys present in the form&#39;s field_type_map.</p> https://cve.radiocsirt.org/vuln/ghsa-w9gv-h9qh-63cm