WordPress plugin
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent security & vulnerabilities
Unpatched vulnerability in the latest version
At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.
- Critical1
- High2
- Medium13
- Low0
All Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Unauthenticated SQL Injection ≤1.2.12Update to 1.2.13 | CVE-2026-66659 | |
| Medium5.3 | Missing Authorization ≤1.1.30Update to 1.1.31 | CVE-2026-14924 | |
| Medium6.1 | Reflected DOM-Based Cross-Site Scripting via url Parameter ≤5.5.8Update to 5.5.9 | CVE-2024-13362 | |
| Medium6.5 | Authenticated (Subscriber+) SQL Injection ≤1.2.3Update to 1.2.4 | CVE-2026-27373 | |
| High8.8 | 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation 0.5.4 – 1.2.1Update to 1.2.2 | CVE-2025-12845 | |
| Medium4.3 | Missing Authorization ≤1.2.8Update to 1.2.9 | CVE-2026-24524 | |
| Medium4.3 | Missing Authorization ≤1.1.35.1Update to 1.1.35.2 | CVE-2025-68517 | |
| Medium6.5 | Authenticated (Subscriber+) Information Exposure ≤1.1.35.1Update to 1.1.35.2 | CVE-2025-68516 | |
| Medium4.3 | Missing Authorization ≤1.1.34Update to 1.1.35.1 | CVE-2025-66526 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload ≤1.1.32Update to 1.3.33 | CVE-2025-11499 | |
| Medium5.3 | Unauthenticated Sensitive Information Exposure ≤1.0.33Update to 1.0.34 | CVE-2024-37498 | |
| Medium4.3 | Cross-Site Request Forgery ≤1.0.25Update to 1.0.26 | CVE-2024-31388 | |
| Medium6.1 | Reflected Cross-Site Scripting ≤1.0.27Update to 1.0.28 | CVE-2024-29110 | |
| Medium6.1 | Reflected Cross-Site Scripting via fs_request_get ≤1.9.2No patch available | CVE-2023-33999 | |
| Medium6.1 | Reflected Cross-Site Scripting <1.0.9Update to 1.0.9 | CVE-2023-1890 | |
| Medium6.3 | Missing Authorization Checks all versionsNo patch available | CVE-2022-4974 |
- High7.5Unauthenticated SQL Injection
≤1.2.12Update to 1.2.13
- Medium5.3Missing Authorization
≤1.1.30Update to 1.1.31
- Medium6.1Reflected DOM-Based Cross-Site Scripting via url Parameter
≤5.5.8Update to 5.5.9
- Medium6.5Authenticated (Subscriber+) SQL Injection
≤1.2.3Update to 1.2.4
- High8.81.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation
0.5.4 – 1.2.1Update to 1.2.2
- Medium4.3Missing Authorization
≤1.2.8Update to 1.2.9
- Medium4.3Missing Authorization
≤1.1.35.1Update to 1.1.35.2
- Medium6.5Authenticated (Subscriber+) Information Exposure
≤1.1.35.1Update to 1.1.35.2
- Medium4.3Missing Authorization
≤1.1.34Update to 1.1.35.1
- Critical9.8Unauthenticated Arbitrary File Upload
≤1.1.32Update to 1.3.33
- Medium5.3Unauthenticated Sensitive Information Exposure
≤1.0.33Update to 1.0.34
- Medium4.3Cross-Site Request Forgery
≤1.0.25Update to 1.0.26
- Medium6.1Reflected Cross-Site Scripting
≤1.0.27Update to 1.0.28
- Medium6.1Reflected Cross-Site Scripting via fs_request_get
≤1.9.2No patch available
- Medium6.1Reflected Cross-Site Scripting
<1.0.9Update to 1.0.9
- Medium6.3Missing Authorization Checks
all versionsNo patch available
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent: common questions
Does Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent have known vulnerabilities?
Yes. VulnCrest Radar lists 16 known vulnerabilities in Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent: 1 critical, 2 high, 13 medium. At least one is not fixed in the latest version.
How do I check which version of Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent vulnerability?
CVE-2026-66659, published Aug 11, 2026: Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.12 - Unauthenticated SQL Injection. Severity: High (CVSS 7.5).
Is any Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent vulnerability listed in CISA KEV?
No. None of the known Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent vulnerabilities is currently listed in the CISA KEV catalog.