Forminator vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

FO

Product

Forminator

by WPMU DEV · last CVE Oct 12, 2026

17

CVEs

0

On KEV

9.8

Max CVSS

7

New 30D

Vulnerabilities17 In the news0 Timeline

Severity mix

Critical 1High 10Medium 6Low 0

Severity

All severities17 Critical1 High10 Medium6 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Forminator to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-66583	9.8	1%	Aug 20	WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability Affected: through 1.57.0
CVE-2026-28111	8.8	0%	Aug 6	WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability Affected: through 1.56.0
CVE-2026-96341	8.2	0%	Oct 10	WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability Affected: through 1.57.3
CVE-2026-65459	7.5	0%	Oct 10	WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability Affected: through 1.57.3
CVE-2026-96336	7.5	0%	Oct 9	WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability Affected: through 1.57.2
CVE-2026-96335	7.5	0%	Oct 7	WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability Affected: through 1.57.2
CVE-2024-31077	7.2	30%	Apr 23	Forminator prior to 1.29.3 contains a SQL injection vulnerability Affected: prior to 1.29.3
CVE-2026-102388	7.1	0%	Oct 10	WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability Affected: through 1.57.3
CVE-2026-106611	7.1	0%	Oct 8	WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability Affected: through 1.57.3
CVE-2026-28143	7.1	0%	Aug 6	WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability Affected: through 1.56.0
CVE-2026-56071	7.1	0%	Jun 25	WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability Affected: through 1.53.1
CVE-2024-45625	6.1	0%	Sep 9	Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1 Affected: prior to 1.34.1
CVE-2021-36821	6.1	0%	Mar 16	WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability Affected: through 1.14.11
CVE-2024-31857	5.4	1%	Apr 23	Forminator prior to 1.15.4 contains a cross-site scripting vulnerability Affected: prior to 1.15.4
CVE-2026-108486	5.3	0%	Oct 12	WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability Affected: through 1.58.0
CVE-2026-82220	5.3	0%	Aug 28	WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability Affected: through 1.57.1
CVE-2024-28890	5.3	1%	Apr 23	Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability Affected: prior to 1.29.0