sales@hackhalt.com
Free Download

Live Vulnerability Intelligence

Threat Database

Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.

Total62
Critical4
High26
Medium31
Reset
Showing 1-20 of 62 records
Threat Entry Updated 2026-10-30

Forminator - Security Vulnerability (CVE-2026-97638)

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared "continue…

PLUGIN Forminator

CVE-2026-97638

HIGH CVSS 7.5 2026-10-30
Open Full Technical Breakdown
Threat Entry Updated 2026-10-30

Forminator - Security Vulnerability (CVE-2026-5461)

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.

PLUGIN Forminator

CVE-2026-5461

MEDIUM CVSS 6.5 2026-10-30
Open Full Technical Breakdown
Threat Entry Updated 2026-10-01

Forminator - Security Vulnerability (CVE-2026-92144)

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form submission nonce is freely obtainable by unauthenticated users via the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint, making the full attack chain exploitable without any authentication…

PLUGIN Forminator

CVE-2026-92144

HIGH CVSS 7.2 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-10-01

Forminator - Security Vulnerability (CVE-2026-85235)

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to open the stored submission entry in the Forminator Entries view and interact with the planted link, at which point…

PLUGIN Forminator

CVE-2026-85235

HIGH CVSS 7.2 2026-10-01
Open Full Technical Breakdown
Threat Entry Updated 2026-09-21

Forminator - Security Vulnerability (CVE-2026-92229)

The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

PLUGIN Forminator

CVE-2026-92229

CRITICAL CVSS 9.1 2026-09-19
Open Full Technical Breakdown
Threat Entry Updated 2026-08-28

Forminator - Cross-Site Scripting (XSS) (CVE-2026-18324)

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted Textarea field has the Rich-Text editor option enabled.

PLUGIN Forminator

CVE-2026-18324

HIGH CVSS 7.2 2026-08-28
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Forminator - Cross-Site Scripting (XSS) (CVE-2026-18328)

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only triggerable on pages hosting a Forminator form configured to use the Stripe Checkout Sessions payment API, which became the default…

PLUGIN Forminator

CVE-2026-18328

HIGH CVSS 7.2 2026-08-25
Open Full Technical Breakdown
Threat Entry Updated 2026-08-26

Forminator - Cross-Site Scripting (XSS) (CVE-2026-18323)

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the Save-and-Continue draft submission AJAX endpoint is registered as nopriv, allowing unauthenticated attackers to bypass radio field option-membership…

PLUGIN Forminator

CVE-2026-18323

HIGH CVSS 7.2 2026-08-25
Open Full Technical Breakdown
Threat Entry Updated 2026-10-22

Forminator - Remote Code Execution (CVE-2026-15748)

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

PLUGIN Forminator

CVE-2026-15748

CRITICAL CVSS 9.8 2026-08-18
Open Full Technical Breakdown

WordPress security that blocks attacks before they land.

sales@hackhalt.com

Product

Resources

Company

© Hack Halt Inc. All rights reserved.