CVE-2026-66425

MediumCVSS 6.5/10Last modified Oct 24, 2026

Description

Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-288

Affected software

No affected versions have been published.

Timeline

Published
Aug 6, 2026
Last modified
Oct 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-664267.1Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.CVE-2026-664277.6Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.CVE-2026-664284.3Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.CVE-2026-664297.1Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.CVE-2026-66439.9A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and CVE-2026-664308.5Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.CVE-2026-664317.5Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.CVE-2026-664327.5Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.CVE-2026-664336.5Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.CVE-2026-664346.5Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.CVE-2026-664355.9Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive DCVE-2026-664369.3Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.
CVE-2026-66425: Medium severity, CVSS 6.5 | Vulnix