Advisories · Technology
Forminator Forms.
Every CVE that names Forminator Forms among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.3 Medium
Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts
- Forminator Forms
- CWE-20
- CVSS 5.3 Medium
Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing
- Forminator Forms
- CWE-348
- CVSS 3.7 Low
Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link
- Forminator Forms
- Broken access control
- CVSS 3.1 Low
Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe
- Forminator Forms
- Broken access control
- CVSS 6.6 Medium
Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import
- Forminator Forms
- Privilege escalation
- CVSS 8.5 High
Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection
- Forminator Forms
- Code injection
- CVSS 3.7 Low
Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation
- Forminator Forms
- Privilege escalation
- CVSS 6.6 Medium
Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass
- Forminator Forms
- Privilege escalation
- CVSS 7.2 High
Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite
- Forminator Forms
- Code injection
- CVSS 4.8 Medium
Forminator < 1.38.3 - Admin+ Stored XSS
- Forminator Forms