Unknown Forminator Forms vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 20269

Newest CVEs

• CVE-2026-87071

  Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts

  Unknown · Forminator Forms

  Medium5.3
• CVE-2026-87070

  Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing

  Unknown · Forminator Forms

  Medium5.3
• CVE-2026-87074

  Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link

  Unknown · Forminator Forms

  Low3.7
• CVE-2026-87069

  Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe

  Unknown · Forminator Forms

  Low3.1
• CVE-2026-87068

  Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import

  Unknown · Forminator Forms

  Medium6.6
• CVE-2026-87067

  Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection

  Unknown · Forminator Forms

  High8.5
• CVE-2026-19220

  Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation

  Unknown · Forminator Forms

  Low3.7
• CVE-2026-19222

  Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass

  Unknown · Forminator Forms

  Medium6.6
• CVE-2026-19221

  Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite

  Unknown · Forminator Forms

  High7.2
• CVE-2024-7052

  Forminator < 1.38.3 - Admin+ Stored XSS

  Unknown · Forminator Forms

  Medium4.8