Skip to content
OpenAdvisories

Product · WPMU DEV

Forminator

20 known vulnerabilities.

Forminator at a glance

Last 12 months
15
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 0 vulnerabilities August 2026: 4 vulnerabilities, 1 critical September 2026: 0 vulnerabilities Sep October 2026: 7 vulnerabilities November 2026: 3 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202630
Oct 202670
Sep 202600
Aug 202641
Jul 202600
Jun 202610
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

20 results · Feed

  • Medium 6.5
    CVE-2026-115952

    WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3.

    WPMU DEV Forminator
  • Medium 5.3
    CVE-2026-116859

    WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.3.

    WPMU DEV Forminator
  • Medium 4.3
    CVE-2026-116858

    WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code Injection.This issue affects Forminator: from n/a through 1.58.3.

    WPMU DEV Forminator
  • Medium 5.3
    CVE-2026-108486

    WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.

    WPMU DEV Forminator
  • High 7.5
    CVE-2026-65459

    WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability

    Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

    WPMU DEV Forminator
  • High 8.2
    CVE-2026-96341

    WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

    WPMU DEV Forminator
  • High 7.1
    CVE-2026-102388

    WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.

    WPMU DEV Forminator
  • High 7.5
    CVE-2026-96336

    WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability

    Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.

    WPMU DEV Forminator
  • High 7.1
    CVE-2026-106611

    WordPress Forminator plugin <= 1.57.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.

    WPMU DEV Forminator
  • High 7.5
    CVE-2026-96335

    WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2.

    WPMU DEV Forminator
  • Medium 5.3
    CVE-2026-82220

    WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability

    Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.

    WPMU DEV Forminator
  • Critical 9.8
    CVE-2026-66583

    WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

    WPMU DEV Forminator
  • High 7.1
    CVE-2026-28143

    WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

    WPMU DEV Forminator
  • High 8.8
    CVE-2026-28111

    WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

    Contributor Privilege Escalation in Forminator <= 1.56.0 versions.

    WPMU DEV Forminator
  • High 7.1
    CVE-2026-56071

    WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.

    WPMU DEV Forminator
  • Medium 6.1
    CVE-2024-45625

    Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, a…

    WPMU DEV Forminator
  • Medium 5.3
    CVE-2024-28890

    Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerabi…

    WPMU DEV Forminator
  • High 7.2
    CVE-2024-31077 EPSS 30%

    Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authent…

    WPMU DEV Forminator
  • Medium 5.4
    CVE-2024-31857

    Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote …

    WPMU DEV Forminator
  • High 7.1
    CVE-2021-36821

    WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.14.11.

    WPMU DEV Forminator