CVE-2026-105974: medium-severity vulnerability in Visual Form Builder
Visual Form Builder <= 3.1 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget
Published
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 4.3epss 0.2%
exploitation probability
0.2%top 88% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
The Visual Form Builder WordPress plugin through 3.1 does not perform an authorization check before displaying recent form submission data in a dashboard widget, allowing any authenticated user (Subscriber and above) to read other users' submitted contact information, including names, email addresses, form titles and timestamps.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Visual Form Builderpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/ab69c0b2-e18d-495c-b6a3-546f4fe4c5d9/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Visual Form Builder
In the same product, most dangerous first.
CVE-2022-0140—Visual Form Builder < 3.0.6 - Unauthenticated Information DisclosureEPSS 3.8%CVE-2022-0142—Visual Form Builder < 3.0.6 - CSV InjectionEPSS 2.9%CVE-2021-24514—Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-1046—Visual Form Builder < 3.0.7 - Admin+ Stored Cross-Site ScriptingEPSS 0.6%CVE-2022-0141—Visual Form Builder < 3.0.8 - Entries Deletion/Restoration via CSRFEPSS 0.5%CVE-2026-105973MEDIUMVisual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing AuthorizationEPSS 0.2%