Unknown Forminator Forms vulnerabilities

9 CVEs affecting Unknown Forminator Forms, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-87071, published 2026-09-23.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-19221, published 2026-08-22. High severity, CVSS 7.2. EPSS: 0.7% chance of exploitation in the next 30 days. The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to…
CVE-2026-87067, published 2026-09-20. High severity, CVSS 8.5. EPSS: 0.5% chance of exploitation in the next 30 days. The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its…
CVE-2026-87068, published 2026-09-20. Medium severity, CVSS 6.6. EPSS: 0.4% chance of exploitation in the next 30 days. The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may…
CVE-2026-19222, published 2026-08-22. Medium severity, CVSS 6.6. EPSS: 0.4% chance of exploitation in the next 30 days. The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to…
CVE-2026-87071, published 2026-09-23. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so…
CVE-2026-87074, published 2026-09-23. Low severity, CVSS 3.7. EPSS: 0.2% chance of exploitation in the next 30 days. The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the recipient address and the link written into…
CVE-2026-19220, published 2026-08-26. Low severity, CVSS 3.7. EPSS: 0.1% chance of exploitation in the next 30 days. The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new…
CVE-2026-87069, published 2026-09-23. Low severity, CVSS 3.1. EPSS: 0.1% chance of exploitation in the next 30 days. The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migration during the construction of one of its…
CVE-2026-87070, published 2026-09-23. Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days. The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supplied forwarding headers over the connecting address, and it…