CVE-2026-2002-poc

Sumary The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the formname parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms Unauthenticated Arbitrary File Upload → RCE CVSS 9.8 Critical · Affected: Forminator = 1.56.1 · Patched: 1.56.2 Researcher: daroo Wordfence Bug Bounty, $2,048 · 600k active installs Writeup:...

CVE-2026-111597

The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form...

CVE-2026-111579

The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, ...

CVE-2026-111597 Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Disclosure of Post-Payment Redirect URL and Thank-You Message via Unpaid Stripe Checkout Session

The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form...

CVE-2026-111597

The Forminator Forms WordPress plugin, in versions prior to 1.58.4 , is vulnerable to an unauthenticated disclosure of information. The root cause is that the plugin fails to verify if a Stripe Checkout payment has been completed before returning the after-payment response for a pending submissio...

CVE-2026-111579 Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Privilege Escalation via Paid Registration Form When Stripe Gateway Unavailable

The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, ...

CVE-2026-111579

The Forminator Forms WordPress plugin (versions before 1.58.4 ) is vulnerable to an unauthenticated privilege escalation because it fails to enforce payments on the server side when a configured payment gateway is unavailable. If a gateway was previously connected and is subsequently disconnected...

EUVD-2026-123163

The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, ...

EUVD-2026-123164

The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form...

PT-2026-144995

The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form...

CVE-2026-111597: Unknown Forminator Forms: The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before…

The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form...

CVE-2026-111579: Unknown Forminator Forms: The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's…

The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, ...

PT-2026-144994

The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, ...

CVE-2026-97638

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previousdraftid' parameter due to missing validation on a user controlled key. This makes it...

EUVD-2026-114220

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previousdraftid' parameter due to missing validation on a user controlled key. This makes it...

CVE-2026-97638

The Forminator Forms plugin for WordPress (all versions up to and including 1.57.3.1 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The flaw exists in the previous_draft_id parameter due to a lack of validation on a user-controlled key. Unauthenticated attackers who obtain a vict...

CVE-2026-97638 Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previousdraftid' parameter due to missing validation on a user controlled key. This makes it...

CVE-2026-97638 Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previousdraftid' parameter due to missing validation on a user controlled key. This makes it...

CVE-2026-5461

The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete file...