Verbb

12 CVEs across 4 Verbb products. Browse Verbb vulnerabilities, severities, and proof-of-concept exploits.

Verbb products with known CVEs

ProductCVEs
Formie5
Comments3
Image Resizer2
Knock Knock2
Verbb CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-472662026-05-29Formie is a Craft CMS plugin for creating forms. Prior to 2.2.21 and 3.1.26, unauthenticated users could modify existing submissions by posting a known or gues…
CVE-2026-45697Critical9.82026-05-29Formie is a Craft CMS plugin for creating forms. Prior to 2.2.20 and 3.1.24, unauthenticated users could submit crafted values into Hidden fields (with Default…
CVE-2025-32427Medium5.42025-04-11Formie is a Craft CMS plugin for creating forms. Prior to 2.1.44, when importing a form from JSON, if the field label or handle contained malicious content, th…
CVE-2025-32426Medium4.62025-04-11Formie is a Craft CMS plugin for creating forms. Prior to version 2.1.44, it is possible to inject malicious code into the HTML content of an email notificatio…
CVE-2024-35191Medium4.42024-05-20Formie is a Craft CMS plugin for creating forms. Prior to 2.1.6, users with access to a form's settings can include malicious Twig code into fields that suppor…
CVE-2020-13870Medium5.42020-06-05An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.
CVE-2020-13869Medium5.42020-06-05An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name.
CVE-2020-13868Medium6.52020-06-05An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.
CVE-2020-13486Medium6.12020-05-25The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection.
CVE-2020-13485Critical9.12020-05-25The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header.
CVE-2020-13459Medium5.42020-05-25An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action.
CVE-2020-13458High8.82020-05-25An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action.