Medium
CVE-2026-106611
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 86
Reset filters
Medium
CVE-2026-96335
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.2 - Missing Authorization
High
CVE-2026-92144
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
High
CVE-2026-85235
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
Medium
CVE-2026-87074
Forminator Forms <= 1.57.2.0 - Missing Authorization
Medium
CVE-2026-87071
Forminator Forms <= 1.57.2.0 - Missing Authorization to Unauthenticated Arbitrary Post Meta Injection
Medium
CVE-2026-87069
Forminator Forms <= 1.57.2.0 - Missing Authorization
Medium
CVE-2026-87070
Forminator Forms <= 1.57.2.0 - Unauthenticated Poll Vote Limit Bypass
Critical
CVE-2026-92229
Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
Medium
CVE-2026-87067
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection
High
CVE-2026-87068
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) Privilege Escalation
Medium
CVE-2026-82220
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.1 - Unauthenticated Payment Bypass
Medium
CVE-2026-19222
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.7 - Authenticated (Custom Role+) Privilege Escalation
High
CVE-2026-19220
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.1 - Unauthenticated Privilege Escalation
High
CVE-2026-18324
Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
High
CVE-2026-19221
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.5 - Authenticated (Administrator+) Remote Code Execution
High
CVE-2026-18328
Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
High
CVE-2026-18323
Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
High
CVE-2026-66583
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.0 - Unauthenticated PHP Object Injection
Critical
CVE-2026-15748
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
Medium
CVE-2026-12998
Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter
High
CVE-2026-66659
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.2.9 - Unauthenticated SQL Injection
High
CVE-2026-18325
Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field
High
CVE-2026-28111
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.56.0 - Authenticated (Contributor+) Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.