CVE-2026-2002-poc

概述 Forminator Forms – Contact Form, Payment Form & Custom Form Builder 插件（WordPress）在所有版本中（包括 1.50.2）存在存储型跨站脚本漏洞，该漏洞通过 formname 参数触发，原因是输入清理和输出转义不足。这使得拥有管理员级别权限的认证攻击者能够在页面中注入任意 Web 脚本，当用户访问被注入的页面时脚本将执行。该插件允许管理员将表单管理权限授予较低级别的用户，因此订阅者等用户也有可能利用此漏洞。 根因 该根因需要对逻辑漏洞的敏锐意识： （位于文件 /fields/html.php 中的函数）...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms: subida arbitraria de archivos sin autenticación → RCE CVSS 9.8 Crítico · Afectado: Forminator = 1.56.1 · Parcheado: 1.56.2 Investigador: daroo Wordfence Bug Bounty, $2,048 · 600k instalaciones activas Informe:...

WordPress Forminator Forms plugin < 1.57.0.7 - Authenticated Privilege Escalation vulnerability

Authenticated Privilege Escalation vulnerability discovered by Thanh Lam Tang in WordPress Plugin Forminator versions 1.57.0.7...

WordPress Forminator Forms plugin <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field vulnerability

Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.57.0.1...

CVE-2026-18324

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-18324

Forminator Forms (a WordPress plugin for building contact, payment, and custom forms) is vulnerable to Stored Cross-Site Scripting (XSS) via its Rich-Text Textarea field in all versions up to and including 1.57.0.1 . The root cause is insufficient input sanitization and output escaping , allowing...

EUVD-2026-67405

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-18324 Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-19220

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...

CVE-2026-19220

Forminator Forms WordPress plugin versions before 1.57.1 fail to verify that site registration is enabled on the network before creating a site signup. This allows unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it, effectively a...

EUVD-2026-66274

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...

CVE-2026-19220 Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation

The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it...

CVE-2026-18328

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-18323

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-65314

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...

EUVD-2026-65316

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-18328

The Forminator Forms WordPress plugin (all versions up to and including 1.57.0 ) is vulnerable to DOM-Based Reflected Cross-Site Scripting via the error_description parameter, caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts...

CVE-2026-18323

The Forminator Forms plugin for WordPress (versions up to and including 1.57.0.2 ) is vulnerable to unauthenticated Stored XSS via the Radio Field "Save and Continue Draft" feature. The root cause is insufficient input sanitization and output escaping: the Save-and-Continue AJAX endpoint is regis...

CVE-2026-18328 Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-18323 Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field Save and Continue Draft in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes i...