Forminator Forms – Contact Form, Payment Form & Custom Form Builder

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Forminator Forms – Contact Form, Payment Form & Custom Form Builder

Information

Software Type Plugin
Software Slug forminator (view on wordpress.org)
Software Status Active
Software Author wpmudev
Software Website wpmudev.com
Software Downloads 21,152,974
Software Active Installs 600,000
Software Record Last Updated October 13, 2026

Showing 1-20 of 68 Vulnerabilities

Submit a Vulnerability
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Cross-Site Request Forgery
4.3
CVE-2026-106611
Oct 8, 2026
Researcher: HOMEVO Adonis Orfel
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.2 - Missing Authorization
5.3
CVE-2026-96335
Oct 2, 2026
Researcher: Ananda Dhakal
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
7.2
CVE-2026-92144
Sep 30, 2026
Researcher: Luke Eldridge (system)
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
7.2
CVE-2026-85235
Sep 30, 2026
Researcher: tiborisaak
Forminator Forms <= 1.57.2.0 - Missing Authorization to Unauthenticated Arbitrary Post Meta Injection
5.3
CVE-2026-87071
Sep 21, 2026
Researcher: Dion Mulaj
Forminator Forms <= 1.57.2.0 - Unauthenticated Poll Vote Limit Bypass
5.3
CVE-2026-87070
Sep 21, 2026
Researcher: vuxvinh
Forminator Forms <= 1.57.2.0 - Missing Authorization
5.3
CVE-2026-87074
Sep 21, 2026
Researcher: vuxvinh
Forminator Forms <= 1.57.2.0 - Missing Authorization
4.3
CVE-2026-87069
Sep 21, 2026
Researcher: Karthik Ramakrishnan
Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
9.1
CVE-2026-92229
Sep 18, 2026
Researcher: Kuba
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection
6.6
CVE-2026-87067
Sep 18, 2026
Researcher: Karthik Ramakrishnan
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) Privilege Escalation
7.2
CVE-2026-87068
Sep 18, 2026
Researcher: Karthik Ramakrishnan
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.1 - Unauthenticated Payment Bypass
5.3
CVE-2026-82220
Aug 28, 2026
Researcher: Ahmed Hassan
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.1 - Unauthenticated Privilege Escalation
7.3
CVE-2026-19220
Aug 28, 2026
Researcher: Jakub Herman
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.7 - Authenticated (Custom Role+) Privilege Escalation
6.3
CVE-2026-19222
Aug 28, 2026
Researcher: Thanh Lam Tang
Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
7.2
CVE-2026-18324
Aug 27, 2026
Researcher: daroo
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.5 - Authenticated (Administrator+) Remote Code Execution
7.2
CVE-2026-19221
Aug 27, 2026
Researcher: Jakub Herman
Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
7.2
CVE-2026-18328
Aug 24, 2026
Researcher: Adrien Brunner
Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
7.2
CVE-2026-18323
Aug 24, 2026
Researcher: daroo
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.0 - Unauthenticated PHP Object Injection
8.1
CVE-2026-66583
Aug 19, 2026
Researcher: Ahmed Hassan
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
9.8
CVE-2026-15748
Aug 17, 2026
Researcher: daroo
Title Status CVE ID CVSS Researchers Date
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Cross-Site Request Forgery Patched CVE-2026-106611 4.3 HOMEVO Adonis Orfel October 8, 2026
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.2 - Missing Authorization Patched CVE-2026-96335 5.3 Ananda Dhakal October 2, 2026
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter Patched CVE-2026-92144 7.2 Luke Eldridge (system) September 30, 2026
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field Patched CVE-2026-85235 7.2 tiborisaak September 30, 2026
Forminator Forms <= 1.57.2.0 - Missing Authorization to Unauthenticated Arbitrary Post Meta Injection Patched CVE-2026-87071 5.3 Dion Mulaj September 21, 2026
Forminator Forms <= 1.57.2.0 - Unauthenticated Poll Vote Limit Bypass Patched CVE-2026-87070 5.3 vuxvinh September 21, 2026
Forminator Forms <= 1.57.2.0 - Missing Authorization Patched CVE-2026-87074 5.3 vuxvinh September 21, 2026
Forminator Forms <= 1.57.2.0 - Missing Authorization Patched CVE-2026-87069 4.3 Karthik Ramakrishnan September 21, 2026
Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter Patched CVE-2026-92229 9.1 Kuba September 18, 2026
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection Patched CVE-2026-87067 6.6 Karthik Ramakrishnan September 18, 2026
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) Privilege Escalation Patched CVE-2026-87068 7.2 Karthik Ramakrishnan September 18, 2026
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.1 - Unauthenticated Payment Bypass Patched CVE-2026-82220 5.3 Ahmed Hassan August 28, 2026
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.1 - Unauthenticated Privilege Escalation Patched CVE-2026-19220 7.3 Jakub Herman August 28, 2026
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.7 - Authenticated (Custom Role+) Privilege Escalation Patched CVE-2026-19222 6.3 Thanh Lam Tang August 28, 2026
Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field Patched CVE-2026-18324 7.2 daroo August 27, 2026
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.5 - Authenticated (Administrator+) Remote Code Execution Patched CVE-2026-19221 7.2 Jakub Herman August 27, 2026
Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter Patched CVE-2026-18328 7.2 Adrien Brunner August 24, 2026
Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) Patched CVE-2026-18323 7.2 daroo August 24, 2026
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.0 - Unauthenticated PHP Object Injection Patched CVE-2026-66583 8.1 Ahmed Hassan August 19, 2026
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration Patched CVE-2026-15748 9.8 daroo August 17, 2026

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation