Search

Find a vulnerability

Search criteria

    3 vulnerabilities found for Forminator Forms by Unknown

    CVE-2026-19222 (GCVE-0-2026-19222)

    Vulnerability from nvd – Published: 2026-08-22 06:00 – Updated: 2026-08-22 06:00
    VLAI
    Title
    Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass
    Summary
    The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/bb3997c6-4d9a-46… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Forminator Forms Affected: 0 , < 1.57.0.7 (semver)
    		Create a notification for this product.
    Credits
    Thanh Lam Tang WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Forminator Forms",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.57.0.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Thanh Lam Tang"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Forminator Forms  WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T06:00:17.071Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/bb3997c6-4d9a-46f6-85d7-d472dfc00829/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Forminator Forms \u003c 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-19222",
    "datePublished": "2026-08-22T06:00:17.071Z",
    "dateReserved": "2026-08-07T09:04:29.255Z",
    "dateUpdated": "2026-08-22T06:00:17.071Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-19221 (GCVE-0-2026-19221)

    Vulnerability from nvd – Published: 2026-08-22 06:00 – Updated: 2026-08-22 06:00
    VLAI
    Title
    Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite
    Summary
    The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/5aa85c72-2a60-42… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Forminator Forms Affected: 1.40.0 , < 1.57.0.5 (semver)
    		Create a notification for this product.
    Credits
    Jakub Herman WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Forminator Forms",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.57.0.5",
              "status": "affected",
              "version": "1.40.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Jakub Herman"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Forminator Forms  WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-22T06:00:16.858Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/5aa85c72-2a60-4243-b370-ef0b46e98cfe/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Forminator Forms \u003c 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-19221",
    "datePublished": "2026-08-22T06:00:16.858Z",
    "dateReserved": "2026-08-07T09:04:27.327Z",
    "dateUpdated": "2026-08-22T06:00:16.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-7052 (GCVE-0-2024-7052)

    Vulnerability from nvd – Published: 2025-02-14 06:00 – Updated: 2025-02-14 16:33
    VLAI
    Title
    Forminator < 1.38.3 - Admin+ Stored XSS
    Summary
    The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
    Severity
    4.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2025-02-14 16:33 UTC
    CWE
    Assigner
    References
    URL Tags
    https://wpscan.com/vulnerability/4e52cab5-821c-4c… exploitvdb-entrytechnical-description
    Impacted products
    Vendor Product Version
    Unknown Forminator Forms Affected: 0 , < 1.38.3 (semver)
    		Create a notification for this product.
    Credits
    Dmitrii Ignatyev WPScan
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 4.8,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-7052",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-14T16:33:00.492373Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-14T16:33:41.555Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Forminator Forms",
          "vendor": "Unknown",
          "versions": [
            {
              "lessThan": "1.38.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Dmitrii Ignatyev"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WPScan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Forminator Forms  WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-79 Cross-Site Scripting (XSS)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-14T06:00:09.548Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "exploit",
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://wpscan.com/vulnerability/4e52cab5-821c-4ca8-9024-67f716cf78fe/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Forminator \u003c 1.38.3 - Admin+ Stored XSS",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2024-7052",
    "datePublished": "2025-02-14T06:00:09.548Z",
    "dateReserved": "2024-07-23T19:21:50.848Z",
    "dateUpdated": "2025-02-14T16:33:41.555Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}