addonsorg
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| Drag and Drop File Upload for Contact Form 7 | 1 | – | Apr 24, 2026 |
| Drag and Drop File Upload for Elementor Forms | 1 | – | Sep 10, 2026 |
| PDF for Contact Form 7 + Drag and Drop Template Builder | 1 | – | Dec 12, 2025 |
| PDF for WPForms + Drag and Drop Template Builder | 1 | – | Jan 15, 2025 |
| PDF Invoice for WooCommerce + Drag and Drop Template Builder | 1 | – | Oct 31, 2026 |
| Repeater Fields for Elementor Forms | 1 | – | Sep 25, 2026 |
| Repeater Fields for Gravity Forms | 1 | – | Sep 9, 2026 |
Exploited and recent CVEs
- CVE-2026-109220 PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field 0.5%
- CVE-2026-94573 Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value 0.2%
- CVE-2026-18351 Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload via 'type' Parameter 1.1%
- CVE-2026-84293 Repeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values 0.5%
- CVE-2026-5364 Drag and Drop File Upload for Contact Form 7 <= 1.1.3 - Unauthenticated Arbitrary File Upload via sanitize_file_name Bypass 1.1%
- CVE-2025-14074 PDF for Contact Form 7 + Drag and Drop Template Builder <= 6.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Duplication 0.2%
- CVE-2024-12593 PDF for WPForms + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab Shortcode 0.4%