Visual Form Builder

Visual Form Builder has 10 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2026; 8 are fixed and 2 remain unpatched as of October 2026. Their average CVSS score is 6.0, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 3 high. 2021 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (30%). Other recurring categories include Cross-Site Request Forgery (CSRF), Exposure Of Sensitive Information To An Unauthorized Actor.

8 of the records (80%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2026.

6 independent researchers contributed these findings, most of them (3) reported by Tim Coen.

Strategic Overview

Avg CVSSMedium

6.0/ 10

Patch Coverage80%

Open

Fixed

Get automatic notifications for all Visual Form Builder vulnerabilities before they are exploited.

Most severe open issueCVSS 4.3CVE-2026-105973

Visual Form Builder <= 3.1 - Missing Authorization

Read the full analysis

Vulnerability Records

10 records


2026-10-13 00:00	Visual Form Builder <= 3.1 - Missing Authorization Visual Form Builder <= 3.1	`CVE-2026-105973`	4.3 Medium	Chamseddine Bouzaiene	No
2026-10-13 00:00	Visual Form Builder <= 3.1 - Authenticated (Subscriber+) Information Exposure Visual Form Builder <= 3.1	`CVE-2026-105974`	4.3 Medium	Het Kalariya	No
2022-04-11 00:00	Visual Form Builder <= 3.0.7 - Cross-Site Request Forgery to Data Modification Visual Form Builder < 3.0.8	`CVE-2022-0141`	8.8 High	Vishnupriya Ilango	Yes
2022-04-07 00:00	Visual Form Builder <= 3.0.6 - Admin+ Cross-Site Scripting Visual Form Builder < 3.0.7	`CVE-2022-1046`	5.5 Medium	Akash Rajendra Patil	Yes
2021-11-03 00:00	Visual Form Builder <= 3.0.5 - Unauthenticated Information Disclosure Visual Form Builder < 3.0.6	`CVE-2022-0140`	5.3 Medium	Vishnupriya Ilango	Yes
2021-11-03 00:00	Visual Form Builder <= 3.0.5 - CSV Injection Visual Form Builder < 3.0.6	`CVE-2022-0142`	5.3 Medium	Vishnupriya Ilango	Yes
2021-09-27 00:00	Visual Form Builder <= 3.0.3 - Admin+ Stored Cross-Site Scripting Visual Form Builder <= 3.0.3	`CVE-2021-24514`	4.8 Medium	Felipe Restrepo Rodriguez (pfelilpe)	Yes
2015-05-15 00:00	Visual Form Builder <= 2.8.2 - Reflected Cross-Site Scripting Visual Form Builder < 2.8.3	`N/A`	6.1 Medium	Tim Coen	Yes
2015-05-15 00:00	Visual Form Builder <= 2.8.2 - Cross-Site Request Forgery to SQL Injection Visual Form Builder < 2.8.3	`N/A`	8.8 High	Tim Coen	Yes
2015-05-15 00:00	Visual Form Builder <= 2.8.2 - Authenticated SQL Injection Visual Form Builder < 2.8.3	`N/A`	7.2 High	Tim Coen	Yes

Showing 1–10 of 10 reports