Forminator Forms — Vulnerabilities & Security Advisories 10

All 10 CVE vulnerabilities found in Forminator Forms, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-87071	Forminator Forms < 1.57.2.1 - Unauthenticated Post Meta Injection on Submitted Posts	5.3	Medium	2026-09-23
CVE-2026-87070	Forminator Forms < 1.57.2.1 - Unauthenticated Poll Vote Limit Bypass via IP Spoofing	5.3	Medium	2026-09-23
CVE-2026-87074	Forminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link	-	-	2026-09-23
CVE-2026-87069	Forminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe	-	-	2026-09-23
CVE-2026-87067	Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection	-	-	2026-09-20
CVE-2026-87068	Forminator Forms < 1.57.2.1 - Authenticated Privilege Escalation via Quiz Lead-Form Import	-	-	2026-09-20
CVE-2026-19220	Forminator Forms < 1.57.1 - Unauthenticated Multisite Site Creation and Privilege Escalation	-	-	2026-08-26
CVE-2026-19222	Forminator Forms < 1.57.0.7 - Authenticated Privilege Escalation via Registration Form Role Bypass	-	-	2026-08-22
CVE-2026-19221	Forminator Forms < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite	-	-	2026-08-22
CVE-2024-7052	Forminator < 1.38.3 - Admin+ Stored XSS	4.8	-	2025-02-14

All 10 known CVE vulnerabilities affecting Forminator Forms with full Chinese analysis, references, and POCs where available.