CVE-2026-87068

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

CVE-2026-87067

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...

CVE-2026-87067

The Forminator Forms WordPress plugin (versions before 1.57.2.1 ) is vulnerable to Authenticated Remote Code Execution (RCE) via PHP Object Injection . The flaw exists because the plugin fails to restrict which classes can be instantiated during the deserialization of values received from an XML-...

EUVD-2026-83670

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...

CVE-2026-87067 Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...

CVE-2026-87067 Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...

CVE-2026-87068

The Forminator Forms WordPress plugin (versions before 1.57.2.1 ) is vulnerable to an Authenticated Privilege Escalation flaw. The issue occurs because the plugin fails to apply consistent role validation when a registration form is nested inside an imported quiz. An attacker with permissions to ...

CVE-2026-87068 Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

CVE-2026-87068 Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

EUVD-2026-83671

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

PT-2026-95923

Name of the Vulnerable Software and Affected Versions Forminator Forms WordPress plugin versions prior to 1.57.2.1 Description An issue exists during the deserialization of values from XML-RPC requests where the plugin fails to restrict which classes can be instantiated. This allows users with...

PT-2026-95924

Name of the Vulnerable Software and Affected Versions Forminator Forms versions prior to 1.57.2.1 Description An issue exists where role validation is not applied when a registration form is nested within an imported quiz. This allows a user with permissions to import quizzes to publish a publicl...

CVE-2026-87068: Improper Privilege Management

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrato...

CVE-2026-87067: Improper Control of Generation of Code

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permission to write a file of their choosing and execute arbitrary code. That permissi...

Exploit for CVE-2026-84434

CVE-2026-84434 — Gravity Forms Unauthenticated Arbitrary File...

CVE-2026-15664

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...

EUVD-2026-83574

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-15664 Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-15664 Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-15664

Quill Forms (Conversational Multi Step Forms, Surveys & Quizzes) for WordPress is affected by a stored cross-site scripting vulnerability in all versions up to and including 5.7.1 . The flaw stems from insufficient input sanitization and output escaping in the Multiple Choice "Other" field . An u...