Is Forminator Forms safe?

Every recorded flaw

• Oct 16, 2026The Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary shortcode executionCVE-2026-103911 · affects up to 1.58.1 · reported by WordfenceMedium 6.5
• Oct 16, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary Shortcode ExecutionCVE-2026-101335 · affects up to 1.58.1 · reported by WordfenceMedium 6.5
• Oct 12, 2026Forminator: Missing AuthorizationCVE-2026-108486 · affects up to 1.58.0 · reported by PatchstackMedium 5.3
• Oct 10, 2026Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.CVE-2026-65459 · affects up to 1.57.3 · reported by PatchstackHigh 7.5
• Oct 10, 2026Forminator: Incorrect Privilege AssignmentCVE-2026-96341 · affects up to 1.57.3 · reported by PatchstackHigh 8.2
• Oct 10, 2026Forminator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-102388 · affects up to 1.57.3 · reported by PatchstackHigh 7.1
• Oct 9, 2026Forminator: Authentication Bypass by SpoofingCVE-2026-96336 · affects up to 1.57.2 · reported by PatchstackHigh 7.5
• Oct 8, 2026Forminator: Cross-Site Request Forgery (CSRF)CVE-2026-106611 · affects up to 1.57.3 · reported by PatchstackHigh 7.1
• Oct 7, 2026Forminator: Missing AuthorizationCVE-2026-96335 · affects up to 1.57.2 · reported by PatchstackHigh 7.5
• Oct 1, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-92144 · affects up to 1.57.2 · reported by WordfenceHigh 7.2
• Oct 1, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-85235 · affects up to 1.57.2 · reported by WordfenceHigh 7.2
• Sep 23, 2026Forminator Forms: Does not restrictCVE-2026-87071 · fixed in 1.57.2.1 · reported by WPScanMedium 5.3
• Sep 23, 2026Forminator Forms: Does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting addressCVE-2026-87070 · fixed in 1.57.2.1 · reported by WPScanMedium 5.3
• Sep 23, 2026Forminator Forms: Does not bind its saved-draft notification to the visitor who created the draftCVE-2026-87074 · fixed in 1.57.2.1 · reported by WPScanLow 3.7
• Sep 23, 2026Forminator Forms: Does not perform a nonceCVE-2026-87069 · fixed in 1.57.2.1 · reported by WPScanLow 3.1
• Sep 20, 2026Forminator Forms: Does not apply the role validation it enforces elsewhereCVE-2026-87068 · fixed in 1.57.2.1 · reported by WPScanMedium 6.6
• Sep 20, 2026Forminator Forms: Does not restrictCVE-2026-87067 · fixed in 1.57.2.1 · reported by WPScanHigh 8.5
• Sep 18, 2026The Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary shortcode executionCVE-2026-92229 · affects up to 1.57.2 · reported by WordfenceCritical 9.1
• Aug 28, 2026Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.CVE-2026-82220 · affects up to 1.57.1 · reported by PatchstackMedium 5.3
• Aug 28, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-18324 · affects up to 1.57.0.1 · reported by WordfenceHigh 7.2
• Aug 26, 2026Forminator Forms: Does not verify that site registration is enabled on the network before creating a site signupCVE-2026-19220 · fixed in 1.57.1 · reported by WPScanLow 3.7
• Aug 25, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: DOM-Based Reflected Cross-Site ScriptingCVE-2026-18328 · affects up to 1.57.0 · reported by WordfenceHigh 7.2
• Aug 25, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-18323 · affects up to 1.57.0.2 · reported by WordfenceHigh 7.2
• Aug 22, 2026Forminator Forms: Does not consistently enforce the role restriction it applies to registration formsCVE-2026-19222 · fixed in 1.57.0.7 · reported by WPScanMedium 6.6
• Aug 22, 2026Forminator Forms: Does not restrict a network-wide setting to network administratorsCVE-2026-19221 · fixed in 1.57.0.5 · reported by WPScanHigh 7.2
• Aug 20, 2026Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.CVE-2026-66583 · affects up to 1.57.0 · reported by PatchstackCritical 9.8
• Aug 18, 2026Forminator Forms: Arbitrary File UploadCVE-2026-15748 · affects up to 1.56.1 · reported by Wordfence4.1% oddsCritical 9.8
• Aug 16, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Insecure Direct Object ReferenceCVE-2026-12998 · affects up to 1.55.0.2 · reported by WordfenceMedium 5.3
• Aug 6, 2026Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.CVE-2026-28143 · affects up to 1.56.0 · reported by PatchstackHigh 7.1
• Aug 6, 2026Contributor Privilege Escalation in Forminator <= 1.56.0 versions.CVE-2026-28111 · affects up to 1.56.0 · reported by PatchstackHigh 8.8
• Aug 6, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-18325 · affects up to 1.56.1 · reported by WordfenceHigh 7.2
• Jul 13, 2026Forminator: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-57815 · affects up to 1.55.0.2 · reported by PatchstackHigh 7.5
• Jul 13, 2026Forminator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-57814 · affects up to 1.55.0.1 · reported by PatchstackHigh 7.1
• Jun 25, 2026Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.CVE-2026-56071 · affects up to 1.53.1 · reported by PatchstackHigh 7.1
• May 7, 2026Forminator Forms: Missing AuthorizationCVE-2026-6214 · affects up to 1.53.0 · reported by WordfenceMedium 6.5
• May 6, 2026Forminator Forms: Missing AuthorizationCVE-2026-6222 · affects up to 1.51.1 · reported by WordfenceMedium 5.3
• May 5, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Path TraversalCVE-2026-5192 · affects up to 1.52.1 · reported by WordfenceHigh 7.5
• May 5, 2026Forminator: Authorization bypassCVE-2026-2729 · affects up to 1.52.0 · reported by WordfenceMedium 5.3
• Mar 13, 2026Forminator: Missing AuthorizationCVE-2026-32409 · affects up to 1.50.2 · reported by PatchstackMedium 5.3
• Feb 17, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2026-2002 · affects up to 1.50.2 · reported by WordfenceMedium 4.4
• Jan 9, 2026Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Authorization bypassCVE-2025-14782 · affects up to 1.49.1 · reported by WordfenceMedium 5.3
• Jul 18, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Time-based SQL InjectionCVE-2025-7638 · affects up to 1.45.0 · reported by WordfenceMedium 4.9
• Jul 2, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: PHP Object InjectionCVE-2025-6464 · affects up to 1.44.2 · reported by WordfenceHigh 7.5
• Jul 2, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Arbitrary file deletionCVE-2025-6463 · affects up to 1.44.2 · reported by Wordfence15% oddsHigh 8.8
• Jun 5, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-5341 · affects up to 1.44.1 · reported by WordfenceMedium 6.4
• Apr 17, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-3487 · affects up to 1.42.0 · reported by WordfenceMedium 6.4
• Apr 17, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Order ReplayCVE-2025-3479 · affects up to 1.42.0 · reported by WordfenceMedium 5.3
• Feb 27, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2025-0469 · affects up to 1.39.2 · reported by WordfenceMedium 6.4
• Feb 14, 2025Forminator Forms: Does not sanitise and escape some of its settingsCVE-2024-7052 · fixed in 1.38.3 · reported by WPScanMedium 4.8
• Jan 30, 2025Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Reflected Cross-Site ScriptingCVE-2025-0470 · affects up to 1.38.2 · reported by WordfenceMedium 6.1
• Oct 31, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Insecure Direct Object ReferenceCVE-2024-9700 · affects up to 1.36.0 · reported by WordfenceMedium 5.3
• Oct 26, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Unauthorized accessCVE-2024-10402 · affects up to 1.35.1 · reported by WordfenceHigh 7.5
• Oct 17, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-9352 · affects up to 1.35.1 · reported by WordfenceMedium 4.3
• Oct 17, 2024Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2024-9351 · affects up to 1.35.1 · reported by WordfenceMedium 4.3
• Sep 9, 2024Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1.CVE-2024-45625 · fixed in 1.34.1 · reported by vultures@jpcert.or.jpMedium 6.1
• Aug 2, 2024Forminator: Sensitive Information ExposureCVE-2024-7389 · affects up to 1.29.1 · reported by WordfenceHigh 7.5
• Apr 23, 2024Forminator prior to 1.15.4 contains a cross-site scripting vulnerability.CVE-2024-31857 · fixed in 1.15.4 · reported by vultures@jpcert.or.jpMedium 5.4
• Apr 23, 2024Forminator prior to 1.29.3 contains a SQL injection vulnerability.CVE-2024-31077 · fixed in 1.29.3 · reported by vultures@jpcert.or.jp30% oddsHigh 7.2
• Apr 23, 2024Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability.CVE-2024-28890 · fixed in 1.29.0 · reported by vultures@jpcert.or.jpMedium 5.3
• Apr 9, 2024Forminator – Contact Form, Payment Form & Custom Form Builder: Stored Cross-Site ScriptingCVE-2024-3053 · affects up to 1.29.2 · reported by WordfenceMedium 6.4
• Apr 9, 2024Forminator: Stored Cross-Site ScriptingCVE-2024-1794 · affects up to 1.29.0 · reported by WordfenceHigh 7.2
• Mar 27, 2024Forminator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-29777 · affects up to 1.29.0 · reported by PatchstackHigh 7.1
• Nov 20, 2023Forminator: Does not properly sanitize the redirect-url field in the form submission settingsCVE-2023-5119 · fixed in 1.27.0 · reported by WPScanMedium 4.8
• Nov 15, 2023Forminator: Arbitrary file uploadsCVE-2023-6133 · affects up to 1.27.0 · reported by WordfenceMedium 6.6
• Aug 29, 2023Forminator: Arbitrary file uploadsCVE-2023-4596 · affects up to 1.24.6 · reported by Wordfence14% oddsCritical 9.8
• Jul 31, 2023Forminator: Does not properly escape values that are being reflected inside form fields that use pre-populated query parametersCVE-2023-3134 · fixed in 1.24.4 · reported by WPScan4.1% oddsMedium 6.1
• Jul 12, 2023Forminator – Contact Form, Payment Form & Custom Form Builder: Cross-Site Request ForgeryCVE-2021-4417 · affects up to 1.13.4 · reported by WordfenceMedium 5.4
• Jul 4, 2023Forminator: Does not use an atomic operation to check whether a user has already votedCVE-2023-2010 · fixed in 1.24.1 · reported by WPScanLow 3.1
• Mar 16, 2023Forminator: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2021-36821 · affects up to 1.14.11 · reported by PatchstackHigh 7.1
• Nov 23, 2021Forminator: Does not sanitize and escape the email field labelCVE-2021-24700 · fixed in 1.15.4 · reported by WPScanMedium 4.8
• Mar 4, 2019The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] CVE-2019-9568 · fixed in 1.6 · reported by MITRE1.6% oddsMedium 6.5
• Mar 4, 2019The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.CVE-2019-9567 · fixed in 1.6 · reported by MITRE1.3% oddsMedium 6.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.