Super Forms – Drag & Drop Form Builder

Super Forms – Drag & Drop Form Builder has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; 3 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 8.3, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 1 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 2 of the records (50%). Other recurring categories include Cross-Site Scripting, Path Traversal.

3 of the records (75%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2026.

4 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSHigh

8.3/ 10

Patch Coverage75%

Open

Fixed

Get automatic notifications for all Super Forms – Drag & Drop Form Builder vulnerabilities before they are exploited.

Most severe open issueCVSS 7.5CVE-2026-28167

Super Forms – Drag & Drop Form Builder <= 6.3.315 - Unauthenticated Arbitrary File Read

Read the full analysis

Vulnerability Records

4 records


2026-08-24 07:47	Super Forms – Drag & Drop Form Builder <= 6.3.315 - Unauthenticated Arbitrary File Read Super Forms <= 6.3.315	`CVE-2026-28167`	7.5 High	VanTastic	No
2026-07-09 13:41	Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) Super Forms <= 6.3.313	`CVE-2026-14894`	9.8 Critical	andrea bocchetti	Yes
2022-01-21 00:00	Super Forms - Drag & Drop Form Builder WordPress <= 6.0.3 - Reflected Cross-Site Scripting Super Forms <= 6.0.3	`CVE-2022-0402`	6.1 Medium	Koutrouss Naddara	Yes
2021-01-28 00:00	Super Forms – Drag & Drop Form Builder <= 4.9.700 - Arbitrary File Upload Super Forms <= 4.9.700	`N/A`	9.8 Critical	ABDO10	Yes

Showing 1–4 of 4 reports