Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Forminator Forms 1.57.2.1 Clear all filters
TI-2026-59458 CVE-2026-87068 · GHSA-xq3c-rrxv-22rc

Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import

Priority LOW 31

The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish…

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.00357 Published 2026-09-20 Fixed in 1.57.2.1 CWE-269
TI-2026-59457 CVE-2026-87067 · GHSA-h6cq-4ghp-3r32

Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection

Priority LOW 39

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken from an XML-RPC request, allowing users who hold its forms-management permissio…

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00471 Published 2026-09-20 Fixed in 1.57.2.1 CWE-94