CVE-2026-2002-poc

Resumen El complemento Forminator Forms – Contact Form, Payment Form & Custom Form Builder para WordPress es vulnerable a Cross-Site Scripting Almacenado a través del parámetro formname en todas las versiones hasta la 1.50.2 inclusive, debido a una sanitización insuficiente de entrada y escape de...

WordPress Plugin Forminator 1.24.6 - Arbitrary File Upload

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the uploadpostimage function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload...

CVE-2023-4596

CVE-2023-4596 Script PoC para CVE-2023-4596, ejecución remota de comandos no autenticada mediante subida de archivos arbitrarios. Vídeo del PoC en uso Plantilla de Nuclei Artículo de noticias WordFence NVD Nist Resumen Se ha descubierto una vulnerabilidad crítica en el plugin de WordPress...

CVE-2026-15748

CVE-2026-15748 — Forminator Forms: subida arbitraria de archivos sin autenticación → RCE CVSS 9.8 Crítico · Afectado: Forminator = 1.56.1 · Parcheado: 1.56.2 Investigador: daroo Wordfence Bug Bounty, $2,048 · 600k instalaciones activas Informe:...

cve-2026-15748

CVE-2026-15748 — Forminator Security Scanner A Python-based security research and vulnerability assessment scanner for identifying WordPress installations that use the Forminator plugin and assessing version-related exposure. For Educational & Authorized Testing Only Run this project only against...

WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by tiborisaak in WordPress Plugin Forminator versions = 1.57.2...

CVE-2026-92144

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-90595

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92144

The Forminator Forms plugin for WordPress (all versions up to and including 1.57.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping related to the 'postdata-1[post-custom]' parameter. This allows unauthenticated attackers...

CVE-2026-92144 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92144 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-85235

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-85235

The Forminator Forms WordPress plugin (versions up to and including 1.57.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the Rich-Text Textarea Field . The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attackers to inject arbitrary web scr...

EUVD-2026-90565

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-85235 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-92229

CVE-2026-92229 — Ejecución Arbitraria de Shortcode No Autenticada en Forminator PoC en Python 3, escáner/exploit para CVE-2026-92229 en Forminator WPMU DEV. | ---|--- Plugin| forminator Afectados| ≤ 1.57.2 Corregido en| 1.57.3+ CVSS| 9.1 Crítico Autenticación| No autenticada Vector| Parámetro POS...

WordPress Forminator Forms plugin < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass vulnerability

Unauthenticated Poll Vote Limit Bypass vulnerability discovered by vuxvinh in WordPress Plugin Forminator versions 1.57.2.1...

CVE-2026-87071

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...

CVE-2026-87070

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry...

CVE-2026-87070 Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing

The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it uses that value both to enforce its per-visitor voting limit and to record who submitted an entry...