4 vulnerabilities across 4 products scored HIGH or above on September 19, 2026.

  • 🟠 HIGH: 4

Exploit Status Upgrades

The following CVEs from previous bulletins have been upgraded based on new exploit intelligence:

  • [UPGRADED] CVE-2026-84383 (strukturag/libheif) — F1: exploitable → functional, AAS: 10.9 → 12.9 (HIGH → CRITICAL). Originally in 2026-09-18 bulletin.
  • [UPGRADED] CVE-2026-12793 (jetmonsters/jetformbuilder_—_dynamic_blocks_form_builder) — F1: exploitable → functional, AAS: 10.1 → 12.1 (HIGH → CRITICAL). Originally in 2026-09-16 bulletin.

🟠 [HIGH] gravity_forms/gravity_forms

1 CVE | CVSS 3.1: 9.8 | AAS 10.6

  • cpe:2.3:a:gravity_forms:gravity_forms:*:*:*:*:*:*:*:* (< 3.1.0.5)

Gravity Forms for WordPress versions through 3.1.0.4 are affected by one critical vulnerability (CVE-2026-84434, CVSS 9.8) that allows unauthenticated arbitrary file upload. A validation bypass in the file upload pipeline permits hidden upload fields to skip extension checks, enabling attackers to upload potentially executable files to the server without any authentication.

All WordPress site administrators using Gravity Forms should treat this as an urgent priority, as unauthenticated exploitation can lead to full site compromise. Update immediately to a patched version by consulting the Gravity Forms changelog at docs.gravityforms.com, and review web server logs for any suspicious file upload activity targeting form endpoints.

Vendor Advisory

🟠 [HIGH] wpmudev/forminator_forms_–_contact_form,payment_form&_custom_form_builder

1 CVE | CVSS 3.1: 9.1 | AAS 9.9

  • cpe:2.3:a:wpmudev:forminator_forms_contact_form_payment_form_custom_form_builder:*:*:*:*:*:*:*:*

WPMU DEV Forminator Forms for WordPress versions through 1.57.2 are affected by one critical vulnerability (CVE-2026-92229, CVSS 9.1) that enables unauthenticated arbitrary shortcode execution. Insufficient input validation in the front-end action handler allows attackers to invoke any registered shortcode without authentication, potentially leading to information disclosure, privilege escalation, or further exploitation depending on other plugins installed on the site.

WordPress administrators using Forminator Forms should update to a patched version immediately and audit their sites for signs of unauthorized shortcode activity. Review the vendor’s plugin repository for the latest release and consider temporarily disabling the plugin if an update is not yet available.

Vendor Advisory

🟠 [HIGH] brechtvds/wp_recipe_maker

1 CVE | CVSS 3.1: 9.1 | AAS 9.4

  • cpe:2.3:a:brechtvds:wp_recipe_maker:*:*:*:*:*:*:*:* (< 10.8.2)

WP Recipe Maker for WordPress versions through 10.8.1 are affected by one critical vulnerability (CVE-2026-89274, CVSS 9.1) that allows arbitrary shortcode execution via crafted comment content. The plugin’s metadata sanitization routine recursively passes recipe fields through do_shortcode without stripping shortcode tokens, and since approved comment ratings feed directly into the reviewBody metadata field, attackers can inject and execute arbitrary shortcodes through comment submissions.

Site administrators running WP Recipe Maker should update beyond version 10.8.1 as soon as a patch is available and review approved recipe comments for suspicious shortcode-like content. If no update is available yet, consider temporarily disabling the plugin or restricting comment approvals on recipe posts to reduce exposure.

Vendor Advisory

🟠 [HIGH] openpanel-dev/openpanel

1 CVE | CVSS 4.0: 9.4 | AAS 9.3

  • cpe:2.3:a:openpanel-dev:openpanel:*:*:*:*:*:*:*:*

OpenPanel js-runtime through commit bad75bdd is affected by one critical vulnerability (CVE-2026-93985, CVSS 9.4) that allows sandbox escape and arbitrary code execution in the worker process. The JavaScript webhook template validator fails to block computed member access to constructor chains, enabling attackers with project write access to use computed property notation to reach the Function constructor and execute arbitrary code outside the sandbox.

Teams running OpenPanel with webhook template functionality should update to a patched commit immediately and audit existing webhook templates for suspicious computed property access patterns. Refer to the vendor’s GitHub security advisory (GHSA-6f7h-cvp6-w9w5) for remediation details and patched versions.

Vendor Advisory