FormCraft vulnerabilities
We track 3 vulnerabilities in FormCraft products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on July 23, 2026.
Latest FormCraft vulnerabilities
- 7.2 High severity
FormCraft: Improper Neutralization of Input During Web Page Generation
The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthentic
- 7.2 High severity
FormCraft: Improper Neutralization of Special Elements used in an SQL Command
The FormCraft WordPress plugin before 3.9.7 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- 9.1 Critical severity
FormCraft: Server-Side Request Forgery
The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users