Forminator vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

FO

Product

Forminator

by WPMU DEV · last CVE Oct 12, 2026

13

CVEs

0

On KEV

9.8

Max CVSS

7

New 30D

Vulnerabilities13 In the news0 Timeline

Severity mix

Critical 1High 9Medium 3Low 0

Severity

All severities13 Critical1 High9 Medium3 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Forminator to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-66583	9.8	1%	Aug 20	WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability Affected: through 1.57.0
CVE-2026-28111	8.8	0%	Aug 6	WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability Affected: through 1.56.0
CVE-2026-96341	8.2	0%	Oct 10	WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability Affected: through 1.57.3
CVE-2026-65459	7.5	0%	Oct 10	WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability Affected: through 1.57.3
CVE-2026-96336	7.5	0%	Oct 9	WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability Affected: through 1.57.2
CVE-2026-96335	7.5	0%	Oct 7	WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability Affected: through 1.57.2
CVE-2026-102388	7.1	0%	Oct 10	WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability Affected: through 1.57.3
CVE-2026-106611	7.1	0%	Oct 8	WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 1.57.3
CVE-2026-28143	7.1	0%	Aug 6	WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability Affected: through 1.56.0
CVE-2026-56071	7.1	0%	Jun 25	WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability Affected: through 1.53.1
CVE-2024-45625	6.1	0%	Sep 9	Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1 Affected: prior to 1.34.1
CVE-2026-108486	5.3	0%	Oct 12	WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability Affected: through 1.58.0
CVE-2026-82220	5.3	0%	Aug 28	WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability Affected: through 1.57.1