SS-2026-001 - Template injection RCE in userforms

PKSA-838n-c32y-m854

Affected version: <6.4.10|>=7.0.0,<7.1.4

Reported by:
FriendsOfPHP/security-advisories

SS-2026-005 - XSS in required field label

PKSA-r5k2-9jwp-nhhh

Affected version: <7.1.4

Reported by:
FriendsOfPHP/security-advisories

SS-2026-006 - RCE via template string escaping in userforms email subject

PKSA-761z-bpk5-k27d

Affected version: <6.4.10|>=7.0.0,<7.1.4

Reported by:
FriendsOfPHP/security-advisories

CVE-2026-88991 - RCE in email subject field via template execution

PKSA-kp8m-vvtz-69sm CVE-2026-88991

Affected version: <6.4.10|>=7.0.0,<7.1.4

Reported by:
FriendsOfPHP/security-advisories

CVE-2026-88992 - Userforms CSV export restricted file access

PKSA-w1yx-v3g8-nw8g CVE-2026-88992

Affected version: <7.1.4

Reported by:
FriendsOfPHP/security-advisories

CVE-2026-91111 - Uploaded XML XSS

PKSA-vyds-y4jb-5ff4 CVE-2026-91111

Affected version: <7.1.4

Reported by:
FriendsOfPHP/security-advisories

[HIGH] CVE-2026-54721 - Remote code execution via userforms email subject

PKSA-g6zg-78xs-c8r8 CVE-2026-54721 GHSA-g8wr-r2v2-vqc6

Affected version: <6.4.9|>=7.0.0,<7.0.7|>=7.1.0,<7.1.1

Reported by:
GitHub, FriendsOfPHP/security-advisories