Advisories for packages from verbb

Listing reported advisories for packages from verbb sorted by their report date.

formie's unauthenticated front-end submission editing can overwrite existing submissions
GitHub

verbb/formie

>= 3.0.0, < 3.1.26 · < 2.2.21

2026-05-29 22:19:21
Formie: Pre-authenticated server-side template injection in Hidden fields
GitHub

verbb/formie

>= 3.0.0-beta.1, < 3.1.24 · < 2.2.20

2026-05-18 17:23:40
Formie has XSS vulnerability for email notification content for preview
GitHub

verbb/formie

<= 2.1.43

2025-04-11 19:59:05
Formie has XSS vulnerability for importing forms
GitHub

verbb/formie

<= 2.1.43

2025-04-11 19:58:39
verbb/formie Server-Side Template Injection for variable-enabled settings
GitHub

verbb/formie

< 2.1.6

2024-05-20 20:26:30
Comments plugin stored Cross-site Scripting (XSS) via an asset volume name
GitHub

verbb/comments

< 1.5.5

2024-04-24 18:00:56
Comments plugin Cross-Site Request Forgery (CSRF)
GitHub

verbb/comments

< 1.5.5

2024-04-24 18:00:54
Comments plugin stored Cross-site Scripting via a guest name
GitHub

verbb/comments

< 1.5.5

2024-04-24 18:00:51
Knock Knock plugin Open redirection vulnerability
GitHub

verbb/knock-knock

< 1.2.8

2024-04-24 17:47:25
Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header
GitHub

verbb/knock-knock

< 1.2.8

2024-04-24 17:46:50
Image Resizer Cross-Site Request Forgery (CSRF)
GitHub

verbb/image-resizer

< 2.0.9

2024-04-24 17:43:46
Image Resizer Cross-site Scripting (XSS) in the Bulk Resize action
GitHub

verbb/image-resizer

< 2.0.9

2024-04-24 17:43:44

Need help?

We are happy to help you with any questions you might have.

Documentation Roadmap Report a bug Get in touch