WordPress Vulnerability Scanner WPSec
Vulnerabilities / Forminator Forms – Contact Form, Payment Form & Custom Form Builder

Forminator Forms – Contact Form, Payment Form & Custom Form Builder vulnerabilities

Advisories WPSec published for Forminator Forms – Contact Form, Payment Form & Custom Form Builder. Other sources may list more. Its attack surface: Forminator Forms – Contact Form, Payment Form & Custom Form Builder on WPSec AttackSurface.

PublishedIDVulnerabilitySeverityFixed in
2026-10-15 WPSEC-2026-0998 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via Rendered Block Content Medium 6.5 1.58.2
2026-10-13 WPSEC-2026-0822 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Unauthenticated Sensitive Information Exposure via Scheduled Entry Export Files Medium 5.9 1.58.1
2026-10-13 WPSEC-2026-0821 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Unauthenticated Missing Authorization to AWeber Subscriber Modification Low 3.7 1.58.1
2026-10-08 WPSEC-2026-0624 Forminator Forms <= 1.57.3.1 - Unauthenticated Insecure Direct Object Reference via Stripe PaymentIntent ID Medium 6.5 1.58.0
2026-10-08 WPSEC-2026-0623 Forminator Forms <= 1.57.3.1 - Unauthenticated PayPal Order Request Tampering via Form Submission Medium 5.3 1.58.0
2026-10-08 WPSEC-2026-0622 Forminator Forms <= 1.57.3.1 - Unauthenticated CAPTCHA Bypass on Payment Forms Medium 5.3 1.58.0
2026-10-08 WPSEC-2026-0619 Forminator Forms <= 1.57.3 - Unauthenticated Stored Cross-Site Scripting via Form Submission Values High 7.2 1.57.3.1
2026-10-08 WPSEC-2026-0618 Forminator Forms <= 1.57.3 - Unauthenticated Arbitrary Shortcode Execution via User-Agent Header and Referer URL Medium 5.6 1.57.3.1

License: CC BY 4.0