Vulnerabilities / Forminator Forms
Forminator Forms vulnerabilities
Advisories WPSec published for Forminator Forms – Contact Form, Payment Form & Custom Form Builder. Other sources may list more. Its attack surface: Forminator Forms on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-08 | WPSEC-2026-0624 | Forminator Forms <= 1.57.3.1 - Unauthenticated Insecure Direct Object Reference via Stripe PaymentIntent ID | Medium 6.5 | 1.58.0 |
| 2026-10-08 | WPSEC-2026-0623 | Forminator Forms <= 1.57.3.1 - Unauthenticated PayPal Order Request Tampering via Form Submission | Medium 5.3 | 1.58.0 |
| 2026-10-08 | WPSEC-2026-0622 | Forminator Forms <= 1.57.3.1 - Unauthenticated CAPTCHA Bypass on Payment Forms | Medium 5.3 | 1.58.0 |
| 2026-10-08 | WPSEC-2026-0619 | Forminator Forms <= 1.57.3 - Unauthenticated Stored Cross-Site Scripting via Form Submission Values | High 7.2 | 1.57.3.1 |
| 2026-10-08 | WPSEC-2026-0618 | Forminator Forms <= 1.57.3 - Unauthenticated Arbitrary Shortcode Execution via User-Agent Header and Referer URL | Medium 5.6 | 1.57.3.1 |
License: CC BY 4.0