CVE-2026-19221
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The Forminator Forms WordPress plugin before version 1.57.0.5 does not restrict a network-wide setting to network administrators. An administrator of any single site on a multisite network can execute arbitrary code across the entire network.
Risk Assessment
An administrator of a single site can take over the entire multisite network, compromising all sites and data. This is a critical risk for organizations using WordPress multisite.
Recommendation
Update the Forminator Forms plugin to version 1.57.0.5 or later. Limit trust in individual site administrators and monitor their activities.
Other vulnerabilities in Forminator Forms
See all- CVE-2026-15748Critical
The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.
- CVE-2026-18324High
The Forminator Forms plugin for WordPress up to version 1.57.0.1 is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page. Exploitation requires the targeted Textarea field to have the Rich-Text editor option enabled.
- CVE-2026-19220Low
The Forminator Forms WordPress plugin before version 1.57.1 does not verify that site registration is enabled on the network before creating a site signup. This allows unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it.
- CVE-2026-18328High
The Forminator Forms plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only triggerable on pages hosting a Forminator form configured to use the Stripe Checkout Sessions payment API, which became the default in 1.56.0.
- CVE-2026-18323High
The Forminator Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the Save-and-Continue draft submission AJAX endpoint is registered as nopriv, allowing unauthenticated attackers to bypass radio field option-membership validation and persist a crafted payload that, when rendered on the Submissions admin page, is auto-executed via the bundled Inputmask library's data-attribute callback binding.
- CVE-2026-19222Medium
The Forminator Forms WordPress plugin before version 1.57.0.7 does not consistently enforce role restrictions on registration forms. Users with form-building permissions can configure a form that assigns the administrator role to any visitor who registers through it.
- CVE-2026-12998Medium
The Forminator Forms plugin for WordPress up to version 1.55.0.2 is vulnerable to Insecure Direct Object Reference via the 'draft' parameter. Unauthenticated attackers can enumerate sequential entry IDs and read other users' saved draft data, including names, emails, phone numbers, and message content, when the 'Save and Continue' feature is enabled.
- CVE-2026-18325High
The Forminator Forms plugin for WordPress up to version 1.56.1 is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.
Original NVD description (English source)
The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.