Known vulnerabilities in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin
9 security advisories have been published for the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin. Each entry below states what an attacker can do, what privilege they need, and the version the issue was fixed in.
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder - Cross-Site Scripting (XSS) (CVE-2026-18324) HIGH
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder - Cross-Site Scripting (XSS) (CVE-2026-18328) HIGH
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder - Cross-Site Scripting (XSS) (CVE-2026-18323) HIGH
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder - Remote Code Execution (CVE-2026-15748) CRITICAL
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder - Security Vulnerability (CVE-2026-12998) MEDIUM
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder - Cross-Site Scripting (XSS) (CVE-2026-18325) HIGH
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder - Arbitrary File Upload (CVE-2026-5192) HIGH
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder - Broken Access Control (CVE-2026-2729) MEDIUM
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder - Cross-Site Scripting (XSS) (CVE-2026-2002) MEDIUM