Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent

Software Type	Plugin
Software Slug	tablesome (view on wordpress.org)
Software Status	Active
Software Author	essekia
Software Website	tablesomewp.com
Software Downloads	387,884
Software Active Installs	8,000
Software Record Last Updated	August 14, 2026

16 Vulnerabilities

Submit a Vulnerability

Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.9 - Unauthenticated SQL Injection

7.5

CVE-2026-66659

Aug 11, 2026

Researcher: Nguyen Ba Khanh - HPT Vietnam Corporation

Tablesome <= 1.1.30 - Missing Authorization

5.3

CVE-2026-14924

Jul 7, 2026

Researcher: Kim Dvash

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

6.1

CVE-2024-13362

Apr 30, 2026

Researcher: Asaf Mozes

Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.3 - Authenticated (Subscriber+) SQL Injection

6.5

CVE-2026-27373

Feb 24, 2026

Researcher: daroo

Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation

8.8

CVE-2025-12845

Feb 18, 2026

Researcher: kr0d

Tablesome <= 1.2.8 - Missing Authorization

4.3

CVE-2026-24524

Jan 26, 2026

Researcher: Nabil Irawan

Tablesome <= 1.1.35.1 - Authenticated (Subscriber+) Information Exposure

6.5

CVE-2025-68516

Dec 22, 2025

Researcher: daroo

Tablesome <= 1.1.35.1 - Missing Authorization

4.3

CVE-2025-68517

Dec 22, 2025

Researcher: daroo

Tablesome <= 1.1.34 - Missing Authorization

4.3

CVE-2025-66526

Dec 5, 2025

Researcher: Certus Cybersecurity

Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload

9.8

CVE-2025-11499

Oct 31, 2025

Researcher: Talal Nasraddeen

Table & Contact Form 7 Database – Tablesome <= 1.0.33 - Unauthenticated Sensitive Information Exposure

5.3

CVE-2024-37498

Jul 4, 2024

Researcher: Peng Zhou

Table & Contact Form 7 Database – Tablesome <= 1.0.25 - Cross-Site Request Forgery

4.3

CVE-2024-31388

Apr 10, 2024

Researcher: thiennv

Table & Contact Form 7 Database – Tablesome <= 1.0.27 - Reflected Cross-Site Scripting

6.1

CVE-2024-29110

Mar 16, 2024

Researcher: Jean Tirstan T

Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get

6.1

CVE-2023-33999

Jul 18, 2023

Researcher: Rafie Muhammad

Tablesome <= 1.0.8 - Reflected Cross-Site Scripting

6.1

CVE-2023-1890

Apr 19, 2023

Researcher: Taurus Omar

Freemius SDK <= 2.4.2 - Missing Authorization Checks

6.3

CVE-2022-4974

Mar 4, 2022

Researchers:

Title	Status	CVE ID	CVSS	Researchers	Date
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.9 - Unauthenticated SQL Injection	Unpatched	CVE-2026-66659	7.5	Nguyen Ba Khanh - HPT Vietnam Corporation	August 11, 2026
Tablesome <= 1.1.30 - Missing Authorization	Patched	CVE-2026-14924	5.3	Kim Dvash	July 7, 2026
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter	Patched	CVE-2024-13362	6.1	Asaf Mozes	April 30, 2026
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.3 - Authenticated (Subscriber+) SQL Injection	Patched	CVE-2026-27373	6.5	daroo	February 24, 2026
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent 0.5.4 - 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Information Exposure and Privilege Escalation	Patched	CVE-2025-12845	8.8	kr0d	February 18, 2026
Tablesome <= 1.2.8 - Missing Authorization	Patched	CVE-2026-24524	4.3	Nabil Irawan	January 26, 2026
Tablesome <= 1.1.35.1 - Authenticated (Subscriber+) Information Exposure	Patched	CVE-2025-68516	6.5	daroo	December 22, 2025
Tablesome <= 1.1.35.1 - Missing Authorization	Patched	CVE-2025-68517	4.3	daroo	December 22, 2025
Tablesome <= 1.1.34 - Missing Authorization	Patched	CVE-2025-66526	4.3	Certus Cybersecurity	December 5, 2025
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload	Patched	CVE-2025-11499	9.8	Talal Nasraddeen	October 31, 2025
Table & Contact Form 7 Database – Tablesome <= 1.0.33 - Unauthenticated Sensitive Information Exposure	Patched	CVE-2024-37498	5.3	Peng Zhou	July 4, 2024
Table & Contact Form 7 Database – Tablesome <= 1.0.25 - Cross-Site Request Forgery	Patched	CVE-2024-31388	4.3	thiennv	April 10, 2024
Table & Contact Form 7 Database – Tablesome <= 1.0.27 - Reflected Cross-Site Scripting	Patched	CVE-2024-29110	6.1	Jean Tirstan T	March 16, 2024
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get	Patched	CVE-2023-33999	6.1	Rafie Muhammad	July 18, 2023
Tablesome <= 1.0.8 - Reflected Cross-Site Scripting	Patched	CVE-2023-1890	6.1	Taurus Omar	April 19, 2023
Freemius SDK <= 2.4.2 - Missing Authorization Checks	Patched	CVE-2022-4974	6.3		March 4, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation