Forminator
28 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Forminator, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.
Forminator CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 2 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 1 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 1 |
| 2026-07 | 2 |
| 2026-08 | 4 |
| 2026-09 | 0 |
Severity
How the 28 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical2
- High12
- Medium13
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Forminator.
- CVE-2026-82220WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability5.3
- CVE-2026-66583WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability9.8
- CVE-2026-28143WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability7.1
- CVE-2026-28111WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability8.8
- CVE-2026-57815WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerability7.5
- CVE-2026-57814WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerability7.1
- CVE-2026-56071WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability7.1
- CVE-2026-32409WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerability5.3
- CVE-2025-6464Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion7.5
- CVE-2025-6463Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion8.8
- CVE-2024-45625Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows ...6.1
- CVE-2024-7389Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure7.5
- CVE-2024-28890Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by acces...5.3
- CVE-2024-31077Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege may obtain and alter any info...7.2
- CVE-2024-31857Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the u...5.4
Product grouping is registry-driven, with AI assist and human review. How it works