Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-101335 · Microsoft / collected KEV context

cve-program · CVE-2026-101335

• https://www.wordfence.com/threat-intel/vulnerabilities/id/27640d44-1474-416a-8efd-e9524f9d3c7f?source=cve
• https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L2965
• https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1652
• https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/helpers/helper-fields.php#L1476
• https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/modules/quizzes/front/front-mail.php#L36
• https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.3/library/abstracts/abstract-class-front-action.php#L127
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3745883%40forminator&new=3745883%40forminator

No related operational record is retained in the current change model.