Forminator Forms – Contact Form, Payment Form & Custom Form Builder vulnerabilities
Plugin slug forminator · 82 known vulnerabilities · latest disclosed 2026-11-11 · WordPress.org page
Every listed vulnerability has a fix. Version 1.58.4 or later is not affected by any of them. If your site runs an older version, update it.
31 of 82 rated high or critical (CVSS 7 or more).
Known vulnerabilities in Forminator Forms – Contact Form, Payment Form & Custom Form Builder
| Severity | Affected versions | Fixed in | CVE | Published | Details |
|---|---|---|---|---|---|
| High 7.3 | < 1.58.4 | 1.58.4 | CVE-2026-111579 | 2026-11-11 | Advisory |
| Medium 5.3 | < 1.58.4 | 1.58.4 | CVE-2026-111597 | 2026-11-11 | Advisory |
| Medium 6.4 | <= 1.58.3 | 1.58.4 | CVE-2026-115952 | 2026-11-04 | Advisory |
| Medium 5.4 | <= 1.58.3 | 1.58.4 | CVE-2026-116858 | 2026-11-03 | Advisory |
| Medium 5.3 | <= 1.58.3 | 1.58.4 | CVE-2026-116859 | 2026-11-03 | Advisory |
| High 7.5 | <= 1.57.3.1 | 1.58.0 | CVE-2026-97638 | 2026-10-30 | Advisory |
| Medium 6.5 | <= 1.55.0.2 | 1.55.1 | CVE-2026-5461 | 2026-10-29 | Advisory |
| Medium 6.5 | <= 1.58.1 | 1.58.2 | CVE-2026-103911 | 2026-10-15 | Advisory |
| Medium 6.5 | <= 1.58.1 | 1.58.2 | CVE-2026-101335 | 2026-10-15 | Advisory |
| Medium 5.3 | <= 1.58.0 | 1.58.1 | CVE-2026-108486 | 2026-10-12 | Advisory |
| High 7.3 | <= 1.57.3 | 1.58.0 | CVE-2026-96341 | 2026-10-08 | Advisory |
| Medium 5.3 | <= 1.57.3 | 1.58.0 | CVE-2026-65459 | 2026-10-08 | Advisory |
| High 7.2 | <= 1.57.3 | 1.58.0 | CVE-2026-102388 | 2026-10-08 | Advisory |
| Medium 4.3 | <= 1.57.3 | 1.58.0 | CVE-2026-106611 | 2026-10-08 | Advisory |
| Medium 5.3 | <= 1.57.2 | 1.57.3 | CVE-2026-96335 | 2026-10-02 | Advisory |
| Medium 5.3 | <= 1.57.2 | 1.57.2.1 | CVE-2026-96336 | 2026-10-02 | Advisory |
| High 7.2 | <= 1.57.2 | 1.57.2.1 | CVE-2026-92144 | 2026-09-30 | Advisory |
| High 7.2 | <= 1.57.2 | 1.57.2.1 | CVE-2026-85235 | 2026-09-30 | Advisory |
| Medium 5.3 | <= 1.57.2.0 | 1.57.2.1 | CVE-2026-87070 | 2026-09-21 | Advisory |
| Medium 4.3 | <= 1.57.2.0 | 1.57.2.1 | CVE-2026-87069 | 2026-09-21 | Advisory |
| Medium 5.3 | <= 1.57.2.0 | 1.57.2.1 | CVE-2026-87071 | 2026-09-21 | Advisory |
| Medium 5.3 | <= 1.57.2.0 | 1.57.2.1 | CVE-2026-87074 | 2026-09-21 | Advisory |
| Critical 9.1 | <= 1.57.2 | 1.57.3 | CVE-2026-92229 | 2026-09-18 | Advisory |
| High 7.2 | <= 1.57.2.0 | 1.57.2.1 | CVE-2026-87068 | 2026-09-18 | Advisory |
| Medium 6.6 | <= 1.57.2.0 | 1.57.2.1 | CVE-2026-87067 | 2026-09-18 | Advisory |
| High 7.3 | < 1.57.1 | 1.57.1 | CVE-2026-19220 | 2026-08-28 | Advisory |
| Medium 6.3 | < 1.57.0.7 | 1.57.0.7 | CVE-2026-19222 | 2026-08-28 | Advisory |
| Medium 5.3 | <= 1.57.1 | 1.57.2 | CVE-2026-82220 | 2026-08-28 | Advisory |
| High 7.2 | <= 1.57.0.1 | 1.57.0.2 | CVE-2026-18324 | 2026-08-27 | Advisory |
| High 7.2 | < 1.57.0.5 | 1.57.0.5 | CVE-2026-19221 | 2026-08-27 | Advisory |
| High 7.2 | <= 1.57.0 | 1.57.0.1 | CVE-2026-18328 | 2026-08-24 | Advisory |
| High 7.2 | <= 1.57.0.2 | 1.57.0.3 | CVE-2026-18323 | 2026-08-24 | Advisory |
| High 8.1 | <= 1.57.0 | 1.57.1 | CVE-2026-66583 | 2026-08-19 | Advisory |
| Critical 9.8 | <= 1.56.1 | 1.56.2 | CVE-2026-15748 | 2026-08-17 | Advisory |
| Medium 5.3 | <= 1.55.0.2 | 1.55.1 | CVE-2026-12998 | 2026-08-15 | Advisory |
| High 7.2 | <= 1.56.1 | 1.56.2 | CVE-2026-18325 | 2026-08-05 | Advisory |
| High 7.2 | <= 1.56.0 | 1.56.1 | CVE-2026-28143 | 2026-08-03 | Advisory |
| High 8.8 | <= 1.56.0 | 1.56.0.1 | CVE-2026-28111 | 2026-08-03 | Advisory |
| High 7.5 | <= 1.55.0.2 | 1.55.1 | CVE-2026-57815 | 2026-07-08 | Advisory |
| High 7.2 | <= 1.55.0.1 | 1.55.0.2 | CVE-2026-57814 | 2026-07-08 | Advisory |
| High 7.2 | <= 1.53.1 | 1.53.2 | CVE-2026-56071 | 2026-06-24 | Advisory |
| Medium 6.5 | <= 1.53.0 | 1.53.0.1 | CVE-2026-6214 | 2026-05-06 | Advisory |
| Medium 5.3 | <= 1.51.1 | 1.52 | CVE-2026-6222 | 2026-05-06 | Advisory |
| High 7.5 | <= 1.52.1 | 1.52.2 | CVE-2026-5192 | 2026-05-04 | Advisory |
| Medium 5.3 | <= 1.52.0 | 1.52.1 | CVE-2026-2729 | 2026-05-04 | Advisory |
| Medium 5.3 | <= 1.50.2 | 1.50.3 | CVE-2026-32409 | 2026-02-22 | Advisory |
| Medium 4.4 | <= 1.50.2 | 1.50.3 | CVE-2026-2002 | 2026-02-16 | Advisory |
| Medium 5.3 | <= 1.49.1 | 1.49.2 | CVE-2025-14782 | 2026-01-08 | Advisory |
| Medium 4.9 | <= 1.45.0 | 1.45.1 | CVE-2025-7638 | 2025-07-17 | Advisory |
| High 7.5 | <= 1.44.2 | 1.44.3 | CVE-2025-6464 | 2025-07-01 | Advisory |
| High 8.8 | <= 1.44.2 | 1.44.3 | CVE-2025-6463 | 2025-07-01 | Advisory |
| Medium 6.4 | <= 1.44.1 | 1.44.2 | CVE-2025-5341 | 2025-06-04 | Advisory |
| Medium 6.4 | <= 1.42.0 | 1.42.1 | CVE-2025-3487 | 2025-04-16 | Advisory |
| Medium 5.3 | <= 1.42.0 | 1.42.1 | CVE-2025-3479 | 2025-04-16 | Advisory |
| Medium 6.4 | 1.39.2 | 1.39.3 | CVE-2025-0469 | 2025-02-26 | Advisory |
| Medium 6.1 | <= 1.38.2 | 1.38.3 | CVE-2025-0470 | 2025-01-30 | Advisory |
| Medium 4.4 | <= 1.38.2 | 1.38.3 | CVE-2024-7052 | 2025-01-24 | Advisory |
| Medium 5.3 | <= 1.36.0 | 1.36.1 | CVE-2024-9700 | 2024-10-30 | Advisory |
| High 7.5 | <= 1.35.1 | 1.36.0 | CVE-2024-10402 | 2024-10-25 | Advisory |
| Medium 4.3 | <= 1.35.1 | 1.36.0 | CVE-2024-9352 | 2024-10-16 | Advisory |
| Medium 4.3 | <= 1.35.1 | 1.36.0 | CVE-2024-9351 | 2024-10-16 | Advisory |
| Medium 6.1 | <= 1.34.0 | 1.34.1 | CVE-2024-45625 | 2024-09-09 | Advisory |
| High 7.5 | <= 1.29.1 | 1.29.2 | CVE-2024-7389 | 2024-08-01 | Advisory |
| Critical 9.1 | <= 1.29.2 | 1.29.3 | CVE-2024-31077 | 2024-04-18 | Advisory |
| Medium 6.1 | <= 1.15.2 | 1.15.4 | CVE-2024-31857 | 2024-04-18 | Advisory |
| Critical 9.8 | <= 1.28.1 | 1.29.0 | CVE-2024-28890 | 2024-04-18 | Advisory |
| Medium 6.4 | <= 1.29.2 | 1.29.3 | CVE-2024-3053 | 2024-04-08 | Advisory |
| High 7.2 | <= 1.29.0 | 1.29.1 | CVE-2024-1794 | 2024-03-29 | Advisory |
| Medium 6.1 | <= 1.29.0 | 1.29.1 | CVE-2024-29777 | 2024-03-25 | Advisory |
| Medium 6.6 | <= 1.27.0 | 1.28.0 | CVE-2023-6133 | 2023-11-14 | Advisory |
| Medium 4.4 | <= 1.26.0 | 1.27.0 | CVE-2023-5119 | 2023-10-27 | Advisory |
| Critical 9.8 | <= 1.24.6 | 1.25.0 | CVE-2023-4596 | 2023-08-29 | Advisory |
| Medium 6.1 | <= 1.24.1 | 1.24.4 | CVE-2023-3134 | 2023-07-10 | Advisory |
| Medium 5.3 | <= 1.23.3 | 1.24.1 | CVE-2023-2010 | 2023-06-12 | Advisory |
| Medium 4.3 | <= 1.22.1 | 1.23.3 | none | 2023-04-12 | Advisory |
| Medium 4.3 | <= 1.22.1 | 1.23.3 | none | 2023-04-12 | Advisory |
| Medium 4.3 | <= 1.22.1 | 1.23.3 | none | 2023-04-12 | Advisory |
| Medium 4.8 | < 1.15.4 | 1.15.4 | CVE-2021-24700 | 2021-10-20 | Advisory |
| High 7.2 | < 1.14.12 | 1.14.12 | CVE-2021-36821 | 2021-07-14 | Advisory |
| Medium 5.4 | < 1.13.5 | 1.13.5 | CVE-2021-4417 | 2021-03-01 | Advisory |
| Medium 6.1 | < 1.6 | 1.6 | CVE-2019-9567 | 2019-02-06 | Advisory |
| Medium 6.5 | < 1.6 | 1.6 | CVE-2019-9568 | 2019-02-06 | Advisory |
Check if a site is affected
Enter a site address to see which version of Forminator Forms – Contact Form, Payment Form & Custom Form Builder and other plugins it runs, and whether they match a known vulnerability.
Questions
Is the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin safe to use?
All 82 known issues are fixed in current versions (1.58.4 or later). Keeping it updated is what matters.
How do I check which version of Forminator Forms – Contact Form, Payment Form & Custom Form Builder my site runs?
In WordPress go to Plugins > Installed Plugins. From the outside, the free PluginPeek scan below reads the version from the site's public files.
How do I fix a vulnerable plugin?
Make a full backup, then update it from Dashboard > Updates and check the site afterwards. If you would rather not, we can do it for a fixed $99, paid after you have checked the site.
Check any WordPress site in one click while you browse: Add PluginPeek to Chrome