Forminator Forms (Unknown) - vulnerabilities (CVEs)
10 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-23. Vendor: Unknown.
CVEs of Forminator Forms
- CVE-2026-87071 - CVSS 5.3 (medium), 2026-09-23: The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys…
- CVE-2026-87070 - CVSS 5.3 (medium), 2026-09-23: The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding…
- CVE-2026-87074 - CVSS 3.7 (low), 2026-09-23: The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the…
- CVE-2026-87069 - CVSS 3.1 (low), 2026-09-23: The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field…
- CVE-2026-87068 - CVSS 6.6 (medium), 2026-09-20: The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an…
- CVE-2026-87067 - CVSS 8.5 (high), 2026-09-20: The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC…
- CVE-2026-19220 - CVSS 3.7 (low), 2026-08-26: The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing…
- CVE-2026-19222 - CVSS 6.6 (medium), 2026-08-22: The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who…
- CVE-2026-19221 - CVSS 7.2 (high), 2026-08-22: The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any…
- CVE-2024-7052 - CVSS 4.8 (medium), 2025-02-14: The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to…
