WebRehab

Products

Product	CVEs	Exploited	Latest
Super Forms – Drag & Drop Form Builder	7	–	Oct 8, 2026
Super Forms	1	–	Aug 24, 2026

CVE-2026-17609 Critical 9.1 Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter 0.3%
CVE-2026-17196 High 8.8 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute 0.5%
CVE-2026-15896 Critical 9.1 Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter 0.9%
CVE-2026-15897 High 8.8 Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login 0.3%
CVE-2026-15983 High 8.1 Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter 0.5%
CVE-2026-15989 Critical 9.8 Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter 0.5%
CVE-2026-28167 High 7.5 WordPress Super Forms plugin <= 6.3.316 - Arbitrary File Download vulnerability 0.5%
CVE-2026-14894 Critical 9.8 Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) 3.5%