Veille CVE

Recherche « WPMU DEV Forminator »

21 CVE

Critique 3 Élevée 13 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « WPMU DEV Forminator » ✕
  1. CVE-2026-103911 6.5 Moyenne

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

    The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.58.1. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes. This is exploitable on any block-theme install via a single unauthenticated GET request to the search results page, or by submitting an anonymous comment on any post with comments enabled; no Forminator-specific content or configuration is required to trigger execution.

  2. CVE-2026-101335 6.5 Moyenne

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.

  3. CVE-2026-108486 5.3 Moyenne

    WPMU DEV Forminator

    Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.

  4. CVE-2026-65459 7.5 Élevée

    WPMU DEV Forminator

    Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

  5. CVE-2026-96341 8.2 Élevée

    WPMU DEV Forminator

    Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

  6. CVE-2026-102388 7.1 Élevée

    WPMU DEV Forminator

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.

  7. CVE-2026-96336 7.5 Élevée

    WPMU DEV Forminator

    Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2.

  8. CVE-2026-106611 7.1 Élevée

    WPMU DEV Forminator

    Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Forminator: from n/a through 1.57.3.

  9. CVE-2026-96335 7.5 Élevée

    WPMU DEV Forminator

    Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2.

  10. CVE-2026-92144 7.2 Élevée

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form submission nonce is freely obtainable by unauthenticated users via the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint, making the full attack chain exploitable without any authentication or prior account.

  11. CVE-2026-85235 7.2 Élevée

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to open the stored submission entry in the Forminator Entries view and interact with the planted link, at which point WordPress core's jQuery-based click handler on `.contextual-help-tabs a` evaluates the entity-decoded href as HTML, firing the attacker's payload in the administrator's authenticated wp-admin session.

  12. CVE-2026-92229 9.1 Critique

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

    The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

  13. CVE-2026-82220 5.3 Moyenne

    WPMU DEV Forminator

    Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.

  14. CVE-2026-18324 7.2 Élevée

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted Textarea field has the Rich-Text editor option enabled.

  15. CVE-2026-18328 7.2 Élevée

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only triggerable on pages hosting a Forminator form configured to use the Stripe Checkout Sessions payment API, which became the default in 1.56.0.

  16. CVE-2026-18323 7.2 Élevée

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the Save-and-Continue draft submission AJAX endpoint is registered as nopriv, allowing unauthenticated attackers to bypass radio field option-membership validation and persist a crafted payload that, when rendered on the Submissions admin page, is auto-executed via the bundled Inputmask library's data-attribute callback binding.

  17. CVE-2026-66583 9.8 Critique

    WPMU DEV Forminator

    Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions.

  18. CVE-2026-15748 9.8 Critique

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

    The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

  19. CVE-2026-12998 5.3 Moyenne

    wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to enumerate sequential integer entry IDs via the 'draft' parameter and read other users' saved draft form data, including names, email addresses, phone numbers, addresses, and free-form message content. This is only exploitable on forms that have the 'Save and Continue' feature enabled.

  20. CVE-2026-28143 7.1 Élevée

    WPMU DEV Forminator

    Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

  21. CVE-2026-28111 8.8 Élevée

    WPMU DEV Forminator

    Contributor Privilege Escalation in Forminator <= 1.56.0 versions.