CVE-2026-13378

HighCVSS 7.2

Published: 11/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

Risk Assessment

An unauthenticated attacker can inject arbitrary web scripts on pages that will execute whenever a user accesses an injected page, potentially leading to session theft, redirects, or data theft.

Recommendation

Immediately update the Form Vibes plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin.

Other vulnerabilities in Form Vibes – Database Manager for Forms

CVE-2026-61947High
The Form Vibes – Database Manager for Forms plugin up to version 1.5.2 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script that executes in the victim's browser.

Original NVD description (English source)

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.