Forminator Forms
Monthly
Authenticated code execution in the Forminator Forms WordPress plugin (before 1.57.2.1) lets a user who holds the plugin's forms-management capability abuse unrestricted class instantiation during deserialization of an XML-RPC value, ultimately writing a file of the attacker's choosing and executing arbitrary code on the server. That capability is granted to administrators by default, so sites that have not delegated it through Forminator's own settings are materially less exposed, but any lower role given forms-management can reach the flaw; exploitation also depends on a reachable XML-RPC interface and a usable PHP gadget chain, which is reflected in the high attack-complexity component of the 8.5 CVSS score (PR:L, AC:H). Publicly available exploit code exists, and a vendor patch shipping in 1.57.2.1 is available, so sites running affected versions should upgrade promptly.
Unauthenticated metadata injection in the Forminator Forms WordPress plugin before 1.57.2.1 allows any visitor who submits a public form to attach arbitrary metadata keys - including keys WordPress reserves for its own use - to the post that submission creates. The issue is confined to forms explicitly configured with Forminator's post-creation feature (forms that collect post content and publish a post per submission); ordinary contact, lead, or newsletter forms that never create posts are not exposed, which keeps real-world reach narrow and impact low (integrity-only). Publicly available exploit code exists per the WPScan reference, exploitation status is not confirmed actively exploited (CISA KEV) and no EPSS value was supplied; the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N yields a 5.3 base score, consistent with a low-to-moderate priority finding.
Unauthenticated attackers can bypass the per-visitor voting limit and falsify the submitter address recorded for form entries in the Forminator Forms WordPress plugin before 1.57.2.1. The plugin prefers client-supplied forwarding headers such as X-Forwarded-For over the actual connecting address without first confirming the request originated from a trusted proxy, so every attacker-controlled request appears to come from a different, self-chosen IP - breaking both the vote-throttling logic and the integrity of stored submission metadata (rated CVSS 5.3, integrity-only impact, no code execution, data disclosure, or availability loss). Publicly available exploit code exists per the WPScan advisory, making this trivially reproducible; it is not reported as confirmed actively exploited (no CISA KEV entry), and exploitation of the voting bypass requires the site to actually host a Forminator poll.
An authenticated user holding the quiz-import capability in the Forminator Forms WordPress plugin (versions 1.57.0 through before 1.57.2.1) can escalate to full site control by embedding a role-assigning registration form inside an imported quiz and publishing it, granting any role - including administrator - to anyone who submits the public form. The plugin enforces role validation in the ordinary form editor and ordinary form import paths but omits that check in the quiz-import code path, making the nested-quiz route the only viable bypass; the identical form is rejected through both normal routes. A vendor patch is available (1.57.2.1) and publicly available exploit code exists, so although the vendor scores this 6.6 (AC:H/PR:H), the assessed vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) is materially higher given that a non-administrator with delegated import rights can achieve complete site compromise.
Privilege escalation in the Forminator Forms WordPress plugin (all versions before 1.57.1) allows unauthenticated remote attackers to register new sites on WordPress multisite networks regardless of whether the network administrator has enabled site registration, granting the attacker administrator-level privileges over each newly created sub-site. This flaw is scoped exclusively to WordPress multisite deployments; standard single-site WordPress installations are completely unaffected regardless of plugin version. No active exploitation has been confirmed by CISA KEV, though WPScan has published a public proof-of-concept and a vendor patch is available at version 1.57.1.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single'. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.36.0 via the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
Authenticated code execution in the Forminator Forms WordPress plugin (before 1.57.2.1) lets a user who holds the plugin's forms-management capability abuse unrestricted class instantiation during deserialization of an XML-RPC value, ultimately writing a file of the attacker's choosing and executing arbitrary code on the server. That capability is granted to administrators by default, so sites that have not delegated it through Forminator's own settings are materially less exposed, but any lower role given forms-management can reach the flaw; exploitation also depends on a reachable XML-RPC interface and a usable PHP gadget chain, which is reflected in the high attack-complexity component of the 8.5 CVSS score (PR:L, AC:H). Publicly available exploit code exists, and a vendor patch shipping in 1.57.2.1 is available, so sites running affected versions should upgrade promptly.
Unauthenticated metadata injection in the Forminator Forms WordPress plugin before 1.57.2.1 allows any visitor who submits a public form to attach arbitrary metadata keys - including keys WordPress reserves for its own use - to the post that submission creates. The issue is confined to forms explicitly configured with Forminator's post-creation feature (forms that collect post content and publish a post per submission); ordinary contact, lead, or newsletter forms that never create posts are not exposed, which keeps real-world reach narrow and impact low (integrity-only). Publicly available exploit code exists per the WPScan reference, exploitation status is not confirmed actively exploited (CISA KEV) and no EPSS value was supplied; the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N yields a 5.3 base score, consistent with a low-to-moderate priority finding.
Unauthenticated attackers can bypass the per-visitor voting limit and falsify the submitter address recorded for form entries in the Forminator Forms WordPress plugin before 1.57.2.1. The plugin prefers client-supplied forwarding headers such as X-Forwarded-For over the actual connecting address without first confirming the request originated from a trusted proxy, so every attacker-controlled request appears to come from a different, self-chosen IP - breaking both the vote-throttling logic and the integrity of stored submission metadata (rated CVSS 5.3, integrity-only impact, no code execution, data disclosure, or availability loss). Publicly available exploit code exists per the WPScan advisory, making this trivially reproducible; it is not reported as confirmed actively exploited (no CISA KEV entry), and exploitation of the voting bypass requires the site to actually host a Forminator poll.
An authenticated user holding the quiz-import capability in the Forminator Forms WordPress plugin (versions 1.57.0 through before 1.57.2.1) can escalate to full site control by embedding a role-assigning registration form inside an imported quiz and publishing it, granting any role - including administrator - to anyone who submits the public form. The plugin enforces role validation in the ordinary form editor and ordinary form import paths but omits that check in the quiz-import code path, making the nested-quiz route the only viable bypass; the identical form is rejected through both normal routes. A vendor patch is available (1.57.2.1) and publicly available exploit code exists, so although the vendor scores this 6.6 (AC:H/PR:H), the assessed vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H) is materially higher given that a non-administrator with delegated import rights can achieve complete site compromise.
Privilege escalation in the Forminator Forms WordPress plugin (all versions before 1.57.1) allows unauthenticated remote attackers to register new sites on WordPress multisite networks regardless of whether the network administrator has enabled site registration, granting the attacker administrator-level privileges over each newly created sub-site. This flaw is scoped exclusively to WordPress multisite deployments; standard single-site WordPress installations are completely unaffected regardless of plugin version. No active exploitation has been confirmed by CISA KEV, though WPScan has published a public proof-of-concept and a vendor patch is available at version 1.57.1.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single'. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.36.0 via the. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.