CVE-2026-2002-poc

Sumary The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the formname parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possib...

WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the uploadpostimage function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload...

CVE-2023-4596

CVE-2023-4596 PoC Script for CVE-2023-4596, unauthenticated Remote Command Execution through arbitrary file uploads. Video of PoC being used Nuclei Template News article WordFence NVD Nist Summary A critical vulnerability has been discovered in the WordPress plugin Forminator, which enables an...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms: subida arbitraria de archivos sin autenticación → RCE CVSS 9.8 Crítico · Afectado: Forminator = 1.56.1 · Parcheado: 1.56.2 Investigador: daroo Wordfence Bug Bounty, $2,048 · 600k instalaciones activas Informe:...

cve-2026-15748

CVE-2026-15748 — Forminator Security Scanner A Python-based security research and vulnerability assessment scanner for identifying WordPress installations that use the Forminator plugin and assessing version-related exposure. For Educational & Authorized Testing Only Run this project only against...

CVE-2026-82220

Unauthenticated Other Vulnerability Type in Forminator = 1.57.1 versions...

CVE-2026-82220 WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability

Unauthenticated Other Vulnerability Type in Forminator = 1.57.1 versions...

EUVD-2026-67735

Unauthenticated Other Vulnerability Type in Forminator = 1.57.1 versions...

CVE-2026-82220

CVE-2026-82220 affects the WordPress Forminator plugin in versions ≤ 1.57.1 . The vulnerability is classified as an unauthenticated issue of the generic "Other" type, rated MEDIUM (CVSS 5.3) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating a low integrity impact exploitable over t...

WordPress Forminator Forms plugin < 1.57.0.7 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by Thanh Lam Tang in WordPress Plugin Forminator versions 1.57.0.7...

WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability

Other vulnerability Type vulnerability discovered by Ahmed Hassan in WordPress Plugin Forminator versions = 1.57.1...

WordPress Forminator Forms plugin <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field vulnerability

Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.57.0.1...

CVE-2026-18324

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-18324

Forminator Forms (a WordPress plugin for building contact, payment, and custom forms) is vulnerable to Stored Cross-Site Scripting (XSS) via its Rich-Text Textarea field in all versions up to and including 1.57.0.1 . The root cause is insufficient input sanitization and output escaping , allowing...

EUVD-2026-67405

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-18324 Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-19220

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...

EUVD-2026-66274

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...

CVE-2026-19220

Forminator Forms WordPress plugin versions before 1.57.1 fail to verify that site registration is enabled on the network before creating a site signup. This allows unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it, effectively a...

CVE-2026-19220 Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...