{"metadata": {"vulnerability": "cve-2026-101335", "count": 15, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-09-28T14:24:04.839Z", "date_only": false, "value": "2026-09-28T14:24:04.839Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-101335", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-28T14:39:11Z", "date_only": false, "value": "2026-09-28T14:39:11.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "cve-2026-101335", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-15T16:02:22Z", "date_only": false, "value": "2026-10-15T16:02:22.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "cve-2026-101335", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-16T04:26:58.967Z", "date_only": false, "value": "2026-10-16T04:26:58.967Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-101335", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-16T04:26:58.967Z", "date_only": false, "value": "2026-10-16T04:26:58.967Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "cve-2026-101335", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T04:42:23.184Z", "date_only": false, "value": "2026-10-16T04:42:23.184212Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117448752664622586", "record": "CVE-2026-101335", "field": "creation_timestamp", "uuid": "1c2f320d-e25d-48c4-a4ed-d56f43fe0b8e", "content": "CVE-2026-101335 Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags The Forminator Forms \u2013 Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.\nhttps://www.cve.org/CVERecord?id=CVE-2026-101335https://www.wordfence.com/threat-intel/vulnerabilities/id/27640d44-1474-416a-8efd-e9524f9d3c7f?source=cvehttps://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L2965https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1652https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1476https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/quizzes/front/front-mail.php#L36https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L127https://plugins.trac.wordpress.org/changeset?reponame=&old=3745883%40forminator&new=3745883%40forminator#wordpress #wpmudev #ForminatorForms\u2013ContactForm,PaymentForm&CustomFormBuilder#CVE_2026_101335#bot", "url": "https://infosec.exchange/users/cve/statuses/117448752664622586"}, {"timestamp": "2026-10-16T05:17:27Z", "date_only": false, "value": "2026-10-16T05:17:27Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-J6GP-6943-4W67", "record": "GHSA-J6GP-6943-4W67", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-16T05:17:27.933Z", "date_only": false, "value": "2026-10-16T05:17:27.933", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-101335", "record": "FKIE_CVE-2026-101335", "field": "published"}, {"timestamp": "2026-10-16T06:30:25Z", "date_only": false, "value": "2026-10-16T06:30:25Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-J6GP-6943-4W67", "record": "GHSA-J6GP-6943-4W67", "field": "published"}, {"timestamp": "2026-10-16T06:30:25Z", "date_only": false, "value": "2026-10-16T06:30:25Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-J6GP-6943-4W67", "record": "GHSA-J6GP-6943-4W67", "field": "modified"}, {"timestamp": "2026-10-16T14:51:26.987Z", "date_only": false, "value": "2026-10-16T14:51:26.987078Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-101335", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-16T14:51:26.987Z", "date_only": false, "value": "2026-10-16T14:51:26.987078Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-101335", "record": "FKIE_CVE-2026-101335", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-16T15:09:40.456Z", "date_only": false, "value": "2026-10-16T15:09:40.456Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-101335", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:09:40.456Z", "date_only": false, "value": "2026-10-16T15:09:40.456Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-101335", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-16T15:16:58.983Z", "date_only": false, "value": "2026-10-16T15:16:58.983", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-101335", "record": "FKIE_CVE-2026-101335", "field": "lastModified"}]}