Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-30
Forminator Forms - Security Vulnerability (CVE-2026-97638)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared "continue…
PLUGIN
Forminator Forms
CVE-2026-97638
Risk Score
Threat Entry
Updated 2026-10-30
Forminator Forms - Security Vulnerability (CVE-2026-5461)
The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory.
PLUGIN
Forminator Forms
CVE-2026-5461
Risk Score
Threat Entry
Updated 2026-10-01
Forminator Forms - Security Vulnerability (CVE-2026-92144)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form submission nonce is freely obtainable by unauthenticated users via the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint, making the full attack chain exploitable without any authentication…
PLUGIN
Forminator Forms
CVE-2026-92144
Risk Score
Threat Entry
Updated 2026-10-01
Forminator Forms - Security Vulnerability (CVE-2026-85235)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to open the stored submission entry in the Forminator Entries view and interact with the planted link, at which point…
PLUGIN
Forminator Forms
CVE-2026-85235
Risk Score
Threat Entry
Updated 2026-09-23
Forminator Forms - Security Vulnerability (CVE-2026-87071)
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their choosing to the post their submission creates.
PLUGIN
Forminator Forms
CVE-2026-87071
Risk Score
Threat Entry
Updated 2026-09-23
Forminator Forms - Security Vulnerability (CVE-2026-87070)
The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry. Unauthenticated visitors can therefore vote without limit on any poll and can choose the address stored against every submission they make.
PLUGIN
Forminator Forms
CVE-2026-87070
Risk Score
Threat Entry
Updated 2026-09-23
Forminator Forms - Security Vulnerability (CVE-2026-87074)
The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into the message from the request, so unauthenticated visitors can make the site send a message from its own mail configuration to any address, carrying a link of their choosing inside the site's own template. The token that authorises the send is handed to the anonymous caller by the Forminator Forms WordPress plugin before 1.57.2.1 itself and can be replayed…
PLUGIN
Forminator Forms
CVE-2026-87074
Risk Score
Threat Entry
Updated 2026-09-23
Forminator Forms - Security Vulnerability (CVE-2026-87069)
The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its admin screens, and that construction happens on every wp-admin request for any logged-in user. Any authenticated user, including a Subscriber with no permissions in the Forminator Forms WordPress plugin before 1.57.2.1, can therefore rewrite the saved field configuration of any form on the site, including a live payment form.
PLUGIN
Forminator Forms
CVE-2026-87069
Risk Score
Threat Entry
Updated 2026-09-21
Forminator Forms - Security Vulnerability (CVE-2026-87067)
The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permission belongs to an administrator by default, and to any role the site has granted it through the Forminator Forms WordPress plugin before 1.57.2.1's own settings, so the issue is reachable well below administrator on sites that use that feature.
PLUGIN
Forminator Forms
CVE-2026-87067
Risk Score
Threat Entry
Updated 2026-09-21
Forminator Forms - Security Vulnerability (CVE-2026-87068)
The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import.
PLUGIN
Forminator Forms
CVE-2026-87068
Risk Score
Threat Entry
Updated 2026-09-21
The Forminator Forms - Security Vulnerability (CVE-2026-92229)
The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
PLUGIN
The Forminator Forms
CVE-2026-92229
Risk Score
Threat Entry
Updated 2026-08-28
Forminator Forms - Cross-Site Scripting (XSS) (CVE-2026-18324)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted Textarea field has the Rich-Text editor option enabled.
PLUGIN
Forminator Forms
CVE-2026-18324
Risk Score
Threat Entry
Updated 2026-08-26
Forminator Forms - Security Vulnerability (CVE-2026-19220)
The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it.
PLUGIN
Forminator Forms
CVE-2026-19220
Risk Score
Threat Entry
Updated 2026-08-26
Forminator Forms - Cross-Site Scripting (XSS) (CVE-2026-18328)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only triggerable on pages hosting a Forminator form configured to use the Stripe Checkout Sessions payment API, which became the default…
PLUGIN
Forminator Forms
CVE-2026-18328
Risk Score
Threat Entry
Updated 2026-08-26
Forminator Forms - Cross-Site Scripting (XSS) (CVE-2026-18323)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the Save-and-Continue draft submission AJAX endpoint is registered as nopriv, allowing unauthenticated attackers to bypass radio field option-membership…
PLUGIN
Forminator Forms
CVE-2026-18323
Risk Score
Threat Entry
Updated 2026-10-12
Forminator Forms - Security Vulnerability (CVE-2026-19221)
The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
PLUGIN
Forminator Forms
CVE-2026-19221
Risk Score
Threat Entry
Updated 2026-10-12
Forminator Forms - Security Vulnerability (CVE-2026-19222)
The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it.
PLUGIN
Forminator Forms
CVE-2026-19222
Risk Score
Threat Entry
Updated 2026-10-22
Forminator Forms - Remote Code Execution (CVE-2026-15748)
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
PLUGIN
Forminator Forms
CVE-2026-15748
Risk Score
Threat Entry
Updated 2026-08-20
Forminator Forms - Security Vulnerability (CVE-2026-12998)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate sequential integer entry IDs via the 'draft' parameter and read other users' saved draft form data, including names, email addresses, phone numbers, addresses, and free-form message content. This is only exploitable on forms that have the 'Save and…
PLUGIN
Forminator Forms
CVE-2026-12998
Risk Score
Threat Entry
Updated 2026-08-12
Forminator Forms - Cross-Site Scripting (XSS) (CVE-2026-18325)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is possible because Forminator_Core::sanitize_array() skips all filtering for keys prefixed with 'select-', and set_field_data() treats a submitted 'return' member as…
PLUGIN
Forminator Forms
CVE-2026-18325
Risk Score