CVE-2026-61947

HighCVSS 7.1

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Summary

The Form Vibes – Database Manager for Forms plugin up to version 1.5.2 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject a malicious script that executes in the victim's browser.

Risk Assessment

The risk includes session theft, redirection to malicious sites, or theft of credentials from users visiting the affected page.

Recommendation

Immediately update the Form Vibes plugin to the latest available version that fixes this vulnerability.

Other vulnerabilities in Form Vibes – Database Manager for Forms

CVE-2026-13378High
The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.