CVE-2026-66583

Versions of Forminator up to 1.53.1 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

The Forminator plugin in versions 1.57.1 and earlier contains an unauthenticated other vulnerability type. An attacker without authentication can exploit this flaw.

Unauthenticated Cross Site Scripting (XSS) in Forminator versions up to and including 1.56.0.

Contributor Privilege Escalation vulnerability in Forminator versions up to 1.56.0. A user with Contributor role can escalate their privileges.

The Forminator plugin for WordPress contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 1.55.0.2.

The Forminator plugin for WordPress contains a DOM-based XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 1.55.0.1.