What’s Vulnerable › Products
wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder vulnerabilities
37 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 34 published in the last 12 months.
Latest wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder vulnerabilities
- CVE-2026-103911 — Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block (CVSS 6.5)
- CVE-2026-101335 — Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags (CVSS 6.5)
- CVE-2026-92144 — Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter (CVSS 7.2)
- CVE-2026-85235 — Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field (CVSS 7.2)
- CVE-2026-87071 — Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts (CVSS 5.3)
- CVE-2026-87070 — Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing (CVSS 5.3)
- CVE-2026-87074 — Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link (CVSS 3.7)
- CVE-2026-87069 — Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe (CVSS 3.1)
- CVE-2026-87068 — Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import (CVSS 6.6)
- CVE-2026-87067 — Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection (CVSS 8.5)
- CVE-2026-92229 — Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter (CVSS 9.1)
- CVE-2026-18324 — Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field (CVSS 7.2)
- CVE-2026-19220 — Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation (CVSS 3.7)
- CVE-2026-18328 — Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter (CVSS 7.2)
- CVE-2026-18323 — Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) (CVSS 7.2)
- CVE-2026-19222 — Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass (CVSS 6.6)
- CVE-2026-19221 — Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite (CVSS 7.2)
- CVE-2026-15748 — Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration (CVSS 9.8)
- CVE-2026-12998 — Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter (CVSS 5.3)
- CVE-2026-18325 — Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field (CVSS 7.2)
- CVE-2026-6214 — Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook (CVSS 6.5)
- CVE-2026-6222 — Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter (CVSS 5.3)
- CVE-2026-5192 — Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' (CVSS 7.5)
- CVE-2026-2729 — Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter (CVSS 5.3)
- CVE-2026-2002 — Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4)