Forminator Forms

WordPress plugin · forminator-forms · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Forminator Forms on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.2	Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite CVE.org	>=1.40.0, <1.57.0.5	v1.57.0.5	CVE-2026-19221	Aug 22, 2026
MEDIUM CVSS 6.6	Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass CVE.org	>=0, <1.57.0.7	v1.57.0.7	CVE-2026-19222	Aug 22, 2026
LOW CVSS 3.7	Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation CVE.org	>=0, <1.57.1	v1.57.1	CVE-2026-19220	Aug 26, 2026
UNKNOWN	Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection CVE.org	>=1.57.0.7, <1.57.2.1	v1.57.2.1	CVE-2026-87067	Sep 20, 2026
UNKNOWN	Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import CVE.org	>=1.57.0, <1.57.2.1	v1.57.2.1	CVE-2026-87068	Sep 20, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.