WordPress security by component
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Plugin description
Forminator Forms – Contact Form, Payment Form & Custom Form Builder is a WordPress component with 3 published CVE records in this archive. The latest tracked vulnerability was published May 05, 2026; the highest CVE/CNA score is 7.5.
Plugin slug:
forminator-forms-contact-form-payment-form-custom-form-builderLatest vulnerability
CVE-2026-5192: Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Filesystem traversal
Forminator Forms – Contact Form, Payment Form & Custom Form Builder is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 1.52.1.
| Safe version |
|
||
|---|---|---|---|
| May 05, 2026 |
CVE-2026-5192
Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Filesystem traversal
Forminator Forms – Contact Form, Payment Form & Custom Form Builder is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 1.52.1.
|
> 1.52.1 |
CVE7.5
NVDPending
|
| Feb 17, 2026 |
CVE-2026-2002
Forminator Forms – Contact Form, Payment Form & Custom Form Builder: Cross-site scripting
Forminator Forms – Contact Form, Payment Form & Custom Form Builder is affected by cross-site scripting. Exploitation requires at least administrator-level access. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE4.4
NVDPending
|
| Jan 09, 2026 |
CVE-2025-14782
Forminator Forms – Contact Form, Payment Form & Custom Form Builder: A security weakness
Forminator Forms – Contact Form, Payment Form & Custom Form Builder is affected by a security weakness. Exploitation requires an authenticated WordPress account. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|