What’s Vulnerable › Products

WPMU DEV Forminator vulnerabilities

35 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.

Check whether your WPMU DEV Forminator version is affected

Latest WPMU DEV Forminator vulnerabilities

• CVE-2026-108486 — WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2026-65459 — WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability (CVSS 7.5)
• CVE-2026-96341 — WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability (CVSS 8.2)
• CVE-2026-102388 — WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-96336 — WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability (CVSS 7.5)
• CVE-2026-106611 — WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1)
• CVE-2026-96335 — WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability (CVSS 7.5)
• CVE-2026-82220 — WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability (CVSS 5.3)
• CVE-2026-66583 — WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability (CVSS 9.8)
• CVE-2026-28143 — WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-28111 — WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability (CVSS 8.8)
• CVE-2026-57815 — WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerability (CVSS 7.5)
• CVE-2026-57814 — WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-56071 — WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
• CVE-2026-32409 — WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerability (CVSS 5.3)
• CVE-2025-6464 — Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion (CVSS 8.8)
• CVE-2025-6463 — Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion (CVSS 8.8)
• CVE-2024-45625 — (CVSS 6.1)
• CVE-2024-7389 — Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure (CVSS 7.5)
• CVE-2024-31857 — (CVSS 5.4)
• CVE-2024-31077 — (CVSS 7.2)
• CVE-2024-28890 — (CVSS 5.3)
• CVE-2024-3053 — Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode (CVSS 5.4)
• CVE-2024-1794 — Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload (CVSS 6.1)
• CVE-2024-29777 — WordPress Forminator plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1)