FF
Product
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
15
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 2High 7Medium 6Low 0
Watch
Add Forminator Forms – Contact Form, Payment Form & Custom Form Builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-15748 | 9.8 | Aug 18 | Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration Affected: through 1.56.1 |
| CVE-2026-92229 | 9.1 | Sep 19 | Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter Affected: through 1.57.2 |
| CVE-2026-5192 | 7.5 | May 5 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' Affected: through 1.52.1 |
| CVE-2026-92144 | 7.2 | Oct 1 | Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter Affected: through 1.57.2 |
| CVE-2026-85235 | 7.2 | Oct 1 | Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field Affected: through 1.57.2 |
| CVE-2026-18324 | 7.2 | Aug 28 | Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field Affected: through 1.57.0.1 |
| CVE-2026-18328 | 7.2 | Aug 25 | Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter Affected: through 1.57.0 |
| CVE-2026-18323 | 7.2 | Aug 25 | Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) Affected: through 1.57.0.2 |
| CVE-2026-18325 | 7.2 | Aug 6 | Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field Affected: through 1.56.1 |
| CVE-2026-103911 | 6.5 | Oct 16 | Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block Affected: through 1.58.1 |
| CVE-2026-101335 | 6.5 | Oct 16 | Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags Affected: through 1.58.1 |
| CVE-2026-6214 | 6.5 | May 7 | Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook Affected: through 1.53.0 |
| CVE-2026-12998 | 5.3 | Aug 16 | Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter Affected: through 1.55.0.2 |
| CVE-2026-6222 | 5.3 | May 7 | Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter Affected: through 1.51.1 |
| CVE-2026-2729 | 5.3 | May 5 | Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter Affected: through 1.52.0 |
Showing 15