WPMU DEV Forminator vulnerabilities
17 vulnerabilities
Known vulnerabilities in WPMU DEV Forminator, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-108486wordpressforminator+1
EPSS score0.23%
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.CVE-2021-36821incsubforminator+2EPSS score0.41%
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.14.11.CVE-2024-31077incsubforminator+2EPSS score30.36%
Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege may obtain and alter any information in the database and cause a denial-of-service (DoS) condition.CVE-2024-31857incsubforminator+2EPSS score0.63%
Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the user's web browser.CVE-2024-45625incsubforminator+2EPSS score0.43%
Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator.CVE-2024-28890incsubforminator+2EPSS score0.71%
Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition.CVE-2026-65459wordpressforminator+1EPSS score0.24%
Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.CVE-2026-102388wordpressforminator+1EPSS score0.15%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.CVE-2026-56071wordpressforminator+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.CVE-2026-66583wordpressforminator+1EPSS score0.56%
Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.CVE-2026-106611wordpressforminator+1EPSS score0.12%
Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.CVE-2026-28111wordpressforminator+1EPSS score0.42%
Contributor Privilege Escalation in Forminator <= 1.56.0 versions.CVE-2026-28143wordpressforminator+1EPSS score0.25%
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.CVE-2026-96336wordpressforminator+1EPSS score0.27%
Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.CVE-2026-96335wordpressforminator+1EPSS score0.20%
Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Forminator: from n/a through 1.57.2.CVE-2026-96341wordpressforminator+1EPSS score0.28%
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.CVE-2026-82220wordpressforminator+1EPSS score0.29%
Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.