GB Forms DB
GB Forms DB has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of October 2026. Their average CVSS score is 9.8, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 0 high.
The most common weakness is Code Injection, behind 1 of the records (100%).
The one issue recorded for GB Forms DB has a vendor fix available, so running the current release closes it.
All of these findings were reported by CVE_hunter. GB Forms DB is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2025-5392GB Forms DB <= 1.0.2 - Unauthenticated Remote Code Execution
Read the full analysisVulnerability Records

GB Forms DB
Author
gb-plugins
GB Forms DB saves every lead from every form on your site in one place — even when the site runs several form plugins, and even for forms built by hand. Each lead keeps what was submitted, the form it came from, the page it was sent from, the date and time, and the technical details the form plugin reported (IP address, browser, hidden fields). Supported forms Contact Form 7 — saved even when the notification email fails to send Elementor Pro forms Gravity Forms Ninja Forms Pojo Forms All forms — any form submitted on the site, including hand-built forms and forms that submit with Ajax Form by selector — only the forms that match a CSS selector Password and payment-card fields are never saved. Login, registration, search, cart and checkout forms are left alone. Managing leads Search every field at once, or search inside one field Filter by form and by date, with quick ranges (7 days, 30 days, 3 months, a year) Pick a form and its fields appear as columns New / read status, with the unread count in the admin menu Trash, restore, delete permanently, and bulk actions Export to CSV — the whole list or just what is filtered. The file opens in Excel with Hebrew and other languages intact. Personal data export and erase through WordPress’s privacy tools For developers Send leads on to a CRM, a mailing list or anything else with an action hook: add_action( 'gbfdb_after_save_6', function ( $data, $lead_id ) { // $data['fields'] — what was submitted, e.g. $data['fields']['your-email'] // $data['meta'] — form_id, type, url, remote_ip, user_agent... }, 10, 2 ); The number after gbfdb_after_save_ is the form ID. Forms saved by “All forms” or “Form by selector” use gbfdb_after_save_forms-{id}, where the ID is the form’s id attribute — their hook is kept apart because anyone can post to it. gbfdb_after_save fires for every form (third argument: the lead type), and after_save_lead receives the lead ID. Filters: gbfdb_before_save_lead (change or skip a lead before it is saved), gbfdb_exclude_field, gbfdb_client_ip (the visitor’s real address behind a proxy or CDN), gbfdb_supported_plugins, gbfdb_forms_settings, gbfdb_capability, gbfdb_page_url, gbfdb_lead_order, gbfdb_field_output_data, gbfdb-before-admin-save, gbfdb-admin-save. Actions: gbfdb_admin_page_add_fieldset and gbfdb_admin_page_add_fieldset_fields add a tab to the settings screen; before_gbfdb_field_output and after_gbfdb_field_output add markup around a field on the lead screen. Docs and support gb-plugins.com
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C