Criticalyesterday
WordPress plugin Forminator Forms - Unauthenticated Arbitrary Shortcode Execution
Forminator Forms is a popular WordPress plugin designed for building custom forms, interactive quizzes, polls, and calculations using a drag-and-drop builder. CVE-2026-92229 Critical 9.1 CVSS-rated vulnerability in the Forminator Forms WordPress plugin (versions ≤ 1.57.2) that allows remote, unauthenticated attackers to execute arbitrary WordPress shortcodes by exploiting a lack of input validation on the current_url parameter during AJAX quiz submissions (forminator_submit_form_quizzes), potentially leading to unauthorized data exposure or deeper site compromise depending on the active shortcodes available on the server.
