Super Forms – Drag & Drop Form Builder

Super Forms – Drag & Drop Form Builder has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 10 are fixed as of October 2026. Their average CVSS score is 8.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 5 critical and 4 high. 2026 was the busiest year with 8 disclosures.

The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 4 of the records (40%). Other recurring categories include Improper Privilege Management, Cross-Site Scripting.

Every one of the 10 issues recorded for Super Forms – Drag & Drop Form Builder has a vendor fix available, so running the current release closes all known holes.

6 independent researchers contributed these findings, most of them (5) reported by d.v4n_s3c.

Strategic Overview

Avg CVSSHigh

8.7/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Super Forms – Drag & Drop Form Builder vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2026-15989

Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter

Read the full analysis

Vulnerability Records

10 records


2026-10-07 16:28	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File Upload via 'extensions' Form Element Attribute Super Forms <= 6.3.316	`CVE-2026-17196`	8.8 High	d.v4n_s3c	Yes
2026-10-07 16:28	Super Forms <= 6.3.316 - Unauthenticated Arbitrary Directory Deletion via 'data[...][files][][subdir]' Parameter Super Forms <= 6.3.316	`CVE-2026-17609`	9.1 Critical	d.v4n_s3c	Yes
2026-10-01 16:34	Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login Super Forms <= 6.3.316	`CVE-2026-15897`	8.8 High	d.v4n_s3c	Yes
2026-10-01 16:32	Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter Super Forms <= 6.3.316	`CVE-2026-15896`	9.1 Critical	afei	Yes
2026-09-30 20:15	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter Super Forms <= 6.3.316	`CVE-2026-15983`	8.1 High	d.v4n_s3c	Yes
2026-09-30 19:23	Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter Super Forms <= 6.3.316	`CVE-2026-15989`	9.8 Critical	d.v4n_s3c	Yes
2026-08-24 07:47	Super Forms – Drag & Drop Form Builder <= 6.3.316 - Unauthenticated Arbitrary File Read Super Forms <= 6.3.316	`CVE-2026-28167`	7.5 High	VanTastic	Yes
2026-07-09 13:41	Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value) Super Forms <= 6.3.313	`CVE-2026-14894`	9.8 Critical	andrea bocchetti	Yes
2022-01-21 00:00	Super Forms - Drag & Drop Form Builder WordPress <= 6.0.3 - Reflected Cross-Site Scripting Super Forms <= 6.0.3	`CVE-2022-0402`	6.1 Medium	Koutrouss Naddara	Yes
2021-01-28 00:00	Super Forms – Drag & Drop Form Builder <= 4.9.700 - Arbitrary File Upload Super Forms <= 4.9.700	`N/A`	9.8 Critical	ABDO10	Yes

Showing 1–10 of 10 reports