Yes, it is. By how much, and if it would be ok for you to allow forms depends on your specific situation.
CSRF with referer checks
If your CSRF protection depends on referer checks, not on a token, allowing forms means that you would be vulnerable to CSRF.
As you disallow scripts, a victim would still need to actually click the form, but that can be achieved via social engineering or maybe ClickJacking.
For example, an attacker could place a paypal button, which would actually add a new admin user, in the hopes that you click it.
Of course, this is also possible with links, but only for GET requests, not for POST requests.
CSRF with existing forms
It sounds that your filter is a general filter, filtering out all possibly dangerous tags. But there are specific situations where you definitely do not want form tags, eg when echoing user input inside forms.
If you eg have a user edit form like this in the admin backend:
<input type="text" name="csrf-token" value="[CSRF token]">
<input type="text" name="password" value="[value from database]">
<input type="text" name="username" value="[value from database]">
<input type="text" name="role" value="[value from database]">
<input type="submit" value="Submit">
Now, a user could name themselves
foobar"><input type="hidden" name="role" value="admin"><input type="submit" value="Submit"></form>. If they now get the admin to edit their profile, they would be admin, without the admin wanting to make them admin.
A form could also be used for phishing attacks. This again depends on the specific context where your user input is put, but theoretically, an attacker could for example display a form asking for login credentials, credit card details, etc, and then send them to their own server.
The hope is that the victim would not interpret the form as user input, but as belonging to your website.