Forminator Vulnerabilities

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated att...

CVSS:

7.2

Affected:

up to 1.57.0.1

Fixed in:

1.57.0.2

Disclosed:

Aug 27, 2026

CVE-2026-18324 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVSS:

7.2

Affected:

up to 1.57.0

Fixed in:

1.57.0.1

Disclosed:

Aug 24, 2026

CVE-2026-18328 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauth...

CVSS:

7.2

Affected:

up to 1.57.0.2

Fixed in:

1.57.0.3

Disclosed:

Aug 24, 2026

CVE-2026-18323 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.57.0. This is due to deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP ch...

CVSS:

8.1

Affected:

up to 1.57.0

Fixed in:

1.57.1

Disclosed:

Aug 19, 2026

CVE-2026-66583 on NVD →

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed...

CVSS:

9.8

Affected:

up to 1.56.1

Fixed in:

1.56.2

Disclosed:

Aug 17, 2026

CVE-2026-15748 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers...

CVSS:

5.3

Affected:

up to 1.55.0.2

Fixed in:

1.55.1

Disclosed:

Aug 15, 2026

CVE-2026-12998 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthen...

CVSS:

7.2

Affected:

up to 1.56.1

Fixed in:

1.56.2

Disclosed:

Aug 5, 2026

CVE-2026-18325 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.56.0. This makes it possible for authenticated attackers, with Contributor-level access and above, to elevate their privileges to that of an administ...

CVSS:

8.8

Affected:

up to 1.56.0

Fixed in:

1.56.0.1

Disclosed:

Aug 3, 2026

CVE-2026-28111 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.56.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scri...

CVSS:

7.2

Affected:

up to 1.56.0

Fixed in:

1.56.1

Disclosed:

Aug 3, 2026

CVE-2026-28143 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.55.0.2. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive inform...

CVSS:

7.5

Affected:

up to 1.55.0.2

Fixed in:

1.55.1

Disclosed:

Jul 8, 2026

CVE-2026-57815 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.55.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web sc...

CVSS:

7.2

Affected:

up to 1.55.0.1

Fixed in:

1.55.0.2

Disclosed:

Jul 8, 2026

CVE-2026-57814 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.53.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scri...

CVSS:

7.2

Affected:

up to 1.53.1

Fixed in:

1.53.2

Disclosed:

Jun 24, 2026

CVE-2026-56071 on NVD →

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_export_schedule() function in library/class-export.php failing to perform a capability check before saving the scheduled export configuration, unlike the parallel...

CVSS:

6.5

Affected:

up to 1.53.0

Fixed in:

1.53.0.1

Disclosed:

May 6, 2026

CVE-2026-6214 on NVD →

The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1. This is due to the `processRequest()` method in `Forminator_Admin_Module_Edit_Page` (admin/abstracts/class-admin-module-edit-page.php) dispatching sensitive module-management actions — including expo...

CVSS:

5.3

Affected:

up to 1.51.1

Fixed in:

1.52

Disclosed:

May 6, 2026

CVE-2026-6222 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 1.52.1 via the 'upload-1[file][file_path]' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server,...

CVSS:

7.5

Affected:

up to 1.52.1

Fixed in:

1.52.2

Disclosed:

May 4, 2026

CVE-2026-5192 on NVD →

The Forminator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.52.0. This is due to the plugin not properly verifying that a user is authorized to perform an action when processing attacker-supplied Stripe PaymentIntent identifiers in the public payment flow. This make...

CVSS:

5.3

Affected:

up to 1.52.0

Fixed in:

1.52.1

Disclosed:

May 4, 2026

CVE-2026-2729 on NVD →

The Forminator plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.50.2. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.50.2

Fixed in:

1.50.3

Disclosed:

Feb 22, 2026

CVE-2026-32409 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form_name parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVSS:

4.4

Affected:

up to 1.50.2

Fixed in:

1.50.3

Disclosed:

Feb 16, 2026

CVE-2026-2002 on NVD →

[en] The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via the 'listen_for_csv_export' function. This is due to the plugin not properly verifying that a user is authorized to perform an action....

Affected:

up to 1.49.2

Fixed in:

1.49.2

Disclosed:

Jan 9, 2026

CVE-2025-14782 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via the 'listen_for_csv_export' function. This is due to the plugin not properly verifying that a user is authorized to perform an action. This...

CVSS:

5.3

Affected:

up to 1.49.1

Fixed in:

1.49.2

Disclosed:

Jan 8, 2026

CVE-2025-14782 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the `order_by` parameter in all versions up to, and including, 1.45.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing...

CVSS:

4.9

Affected:

up to 1.45.0

Fixed in:

1.45.1

Disclosed:

Jul 17, 2025

CVE-2025-7638 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function. This makes it possible for unauthenticated attackers to inje...

CVSS:

7.5

Affected:

up to 1.44.2

Fixed in:

1.44.3

Disclosed:

Jul 1, 2025

CVE-2025-6464 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenticated attackers to...

CVSS:

8.8

Affected:

up to 1.44.2

Fixed in:

1.44.3

Disclosed:

Jul 1, 2025

CVE-2025-6463 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it possible for authentica...

CVSS:

6.4

Affected:

up to 1.44.1

Fixed in:

1.44.2

Disclosed:

Jun 4, 2025

CVE-2025-5341 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and including, 1.42.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVSS:

6.4

Affected:

up to 1.42.0

Fixed in:

1.42.1

Disclosed:

Apr 16, 2025

CVE-2025-3487 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenticated attackers to...

CVSS:

5.3

Affected:

up to 1.42.0

Fixed in:

1.42.1

Disclosed:

Apr 16, 2025

CVE-2025-3479 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and including, 1.39.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacke...

CVSS:

6.4

Affected:

1.39.2 – 1.39.2

Fixed in:

1.39.3

Disclosed:

Feb 26, 2025

CVE-2025-0469 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVSS:

6.1

Affected:

up to 1.38.2

Fixed in:

1.38.3

Disclosed:

Jan 30, 2025

CVE-2025-0470 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with a...

CVSS:

4.4

Affected:

up to 1.38.2

Fixed in:

1.38.3

Disclosed:

Jan 24, 2025

CVE-2024-7052 on NVD →

[en] The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.36.0 via the submit_quizzes() function due to missing validation on the 'entry_id' user controlled key. This makes it possible for u...

Affected:

up to 1.36.1

Fixed in:

1.36.1

Disclosed:

Oct 31, 2024

CVE-2024-9700 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.36.0 via the submit_quizzes() function due to missing validation on the 'entry_id' user controlled key. This makes it possible for unauth...

CVSS:

5.3

Affected:

up to 1.36.0

Fixed in:

1.36.1

Disclosed:

Oct 30, 2024

CVE-2024-9700 on NVD →

[en] The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenticated attackers, with Contributor-level access and above...

Affected:

up to 1.36.0

Fixed in:

1.36.0

Disclosed:

Oct 26, 2024

CVE-2024-10402 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenticated attackers, with Contributor-level access and above, and...

CVSS:

7.5

Affected:

up to 1.35.1

Fixed in:

1.36.0

Disclosed:

Oct 25, 2024

CVE-2024-10402 on NVD →

[en] The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the quiz 'create_module' function. This makes it possible for unauthenticate...

Affected:

up to 1.36.0

Fixed in:

1.36.0

Disclosed:

Oct 17, 2024

CVE-2024-9351 on NVD →

[en] The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the custom form 'create_module' function. This makes it possible for unauthe...

Affected:

up to 1.36.0

Fixed in:

1.36.0

Disclosed:

Oct 17, 2024

CVE-2024-9352 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the custom form 'create_module' function. This makes it possible for unauthentica...

CVSS:

4.3

Affected:

up to 1.35.1

Fixed in:

1.36.0

Disclosed:

Oct 16, 2024

CVE-2024-9352 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the quiz 'create_module' function. This makes it possible for unauthenticated att...

CVSS:

4.3

Affected:

up to 1.35.1

Fixed in:

1.36.0

Disclosed:

Oct 16, 2024

CVE-2024-9351 on NVD →

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.34.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVSS:

6.1

Affected:

up to 1.34.0

Fixed in:

1.34.1

Disclosed:

Sep 9, 2024

CVE-2024-45625 on NVD →

[en] Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator.

Affected:

up to 1.34.1

Fixed in:

1.34.1

Disclosed:

Sep 9, 2024

CVE-2024-45625 on NVD →

[en] The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthorized changes to...

Affected:

up to 1.29.2

Fixed in:

1.29.2

Disclosed:

Aug 2, 2024

CVE-2024-7389 on NVD →

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthorized changes to the p...

CVSS:

7.5

Affected:

up to 1.29.1

Fixed in:

1.29.2

Disclosed:

Aug 1, 2024

CVE-2024-7389 on NVD →

[en] Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the user's web browser.

Affected:

up to 1.15.4

Fixed in:

1.15.4

Disclosed:

Apr 23, 2024

CVE-2024-31857 on NVD →

[en] Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exploited, a remote attacker may obtain sensitive information by accessing files on the server, alter the site that uses the plugin, and cause a denial-of-service (DoS) condition.

Affected:

up to 1.29.0

Fixed in:

1.29.0

Disclosed:

Apr 23, 2024

CVE-2024-28890 on NVD →

[en] Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege may obtain and alter any information in the database and cause a denial-of-service (DoS) condition.

Affected:

up to 1.29.3

Fixed in:

1.29.3

Disclosed:

Apr 23, 2024

CVE-2024-31077 on NVD →

The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.28.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server wh...

CVSS:

9.8

Affected:

up to 1.28.1

Fixed in:

1.29.0

Disclosed:

Apr 18, 2024

CVE-2024-28890 on NVD →

The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'order_by' parameter in all versions up to, and including, 1.29.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVSS:

9.1

Affected:

up to 1.29.2

Fixed in:

1.29.3

Disclosed:

Apr 18, 2024

CVE-2024-31077 on NVD →

The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.15.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scr...

CVSS:

6.1

Affected:

up to 1.15.2

Fixed in:

1.15.4

Disclosed:

Apr 18, 2024

CVE-2024-31857 on NVD →

[en] The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and including, 1.29.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

Affected:

up to 1.29.1

Fixed in:

1.29.1

Disclosed:

Apr 9, 2024

CVE-2024-1794 on NVD →

[en] The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ forminator_form shortcode attribute in versions up to, and including, 1.29.2 due to insufficient input sanitization and output escaping. This makes it possible for authen...

Affected:

up to 1.29.3

Fixed in:

1.29.3

Disclosed:

Apr 9, 2024

CVE-2024-3053 on NVD →

The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ forminator_form shortcode attribute in versions up to, and including, 1.29.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVSS:

6.4

Affected:

up to 1.29.2

Fixed in:

1.29.3

Disclosed:

Apr 8, 2024

CVE-2024-3053 on NVD →

The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and including, 1.29.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages th...

CVSS:

7.2

Affected:

up to 1.29.0

Fixed in:

1.29.1

Disclosed:

Mar 29, 2024

CVE-2024-1794 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Reflected XSS.This issue affects Forminator: from n/a through 1.29.0.

Affected:

up to 1.29.1

Fixed in:

1.29.1

Disclosed:

Mar 27, 2024

CVE-2024-29777 on NVD →

The Forminator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.29.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tri...

CVSS:

6.1

Affected:

up to 1.29.0

Fixed in:

1.29.1

Disclosed:

Mar 25, 2024

CVE-2024-29777 on NVD →

[en] The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).

Affected:

up to 1.27.0

Fixed in:

1.27.0

Disclosed:

Nov 20, 2023

CVE-2023-5119 on NVD →

[en] The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in versions up to, and including, 1.27.0. This makes it possible for authenticated attackers with administrator-level capabilities or above to upload arbitrar...

Affected:

up to 1.28.0

Fixed in:

1.28.0

Disclosed:

Nov 15, 2023

CVE-2023-6133 on NVD →

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in versions up to, and including, 1.27.0. This makes it possible for authenticated attackers with administrator-level capabilities or above to upload arbitrary fil...

CVSS:

6.6

Affected:

up to 1.27.0

Fixed in:

1.28.0

Disclosed:

Nov 14, 2023

CVE-2023-6133 on NVD →

The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'redirect-url' field located in the form submission settings in all versions up to, and including, 1.26.0 due to insufficient input sanitization and output escaping. This makes it...

CVSS:

4.4

Affected:

up to 1.26.0

Fixed in:

1.27.0

Disclosed:

Oct 27, 2023

CVE-2023-5119 on NVD →

[en] The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files...

Affected:

up to 1.25.0

Fixed in:

1.25.0

Disclosed:

Aug 30, 2023

CVE-2023-4596 on NVD →

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible for unauthenticated attackers to upload arbitrary files on t...

CVSS:

9.8

Affected:

up to 1.24.6

Fixed in:

1.25.0

Disclosed:

Aug 29, 2023

CVE-2023-4596 on NVD →

[en] The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.

Affected:

up to 1.24.4

Fixed in:

1.24.4

Disclosed:

Jul 31, 2023

CVE-2023-3134 on NVD →

[en] The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.13.4. This is due to missing or incorrect nonce validation on the listen_for_saving_export_schedule() function. This makes it possible for unauthent...

Affected:

up to 1.13.5

Fixed in:

1.13.5

Disclosed:

Jul 12, 2023

CVE-2021-4417 on NVD →

The Forminator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.24.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tri...

CVSS:

6.1

Affected:

up to 1.24.1

Fixed in:

1.24.4

Disclosed:

Jul 10, 2023

CVE-2023-3134 on NVD →

[en] The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll.

Affected:

up to 1.24.1

Fixed in:

1.24.1

Disclosed:

Jul 4, 2023

CVE-2023-2010 on NVD →

The Forminator plugin for WordPress is vulnerable to a race condition in versions up to, and including, 1.23.3. This is due to improper validation on the poll voting functionality. This makes it possible for unauthenticated attackers to make multiple votes on a poll.

CVSS:

5.3

Affected:

up to 1.23.3

Fixed in:

1.24.1

Disclosed:

Jun 12, 2023

CVE-2023-2010 on NVD →

Affected:

up to 1.14.8.1

Fixed in:

1.14.8.1

Disclosed:

Jun 7, 2023

CVE-2021-4342 on NVD →

Update the WordPress Forminator plugin to the latest available version (at least 1.23.3). Unknown discovered and reported this Broken Access Control vulnerability in WordPress Forminator Plugin. This vulnerability has been fixed in version 1.23.3.

Affected:

up to 1.23.3

Fixed in:

1.23.3

Disclosed:

Apr 13, 2023

The Forminator plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'hubspot_support_request' AJAX function in versions up to, and including, 1.22.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to submit support request...

CVSS:

4.3

Affected:

up to 1.22.1

Fixed in:

1.23.3

Disclosed:

Apr 12, 2023

The Forminator plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'load_recaptcha_preview' AJAX function in versions up to, and including, 1.22.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to preview recaptcha funct...

CVSS:

4.3

Affected:

up to 1.22.1

Fixed in:

1.23.3

Disclosed:

Apr 12, 2023

The Forminator plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'load_hcaptcha_preview' AJAX function in versions up to, and including, 1.22.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to preview hcaptcha functio...

CVSS:

4.3

Affected:

up to 1.22.1

Fixed in:

1.23.3

Disclosed:

Apr 12, 2023

The Forminator plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'load_recaptcha_preview' AJAX function in versions up to, and including, 1.22.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to preview recaptcha funct...

Affected:

up to 1.23.3

Fixed in:

1.23.3

Disclosed:

Apr 12, 2023

The Forminator plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'load_hcaptcha_preview' AJAX function in versions up to, and including, 1.22.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to preview hcaptcha functio...

Affected:

up to 1.23.3

Fixed in:

1.23.3

Disclosed:

Apr 12, 2023

The Forminator plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'hubspot_support_request' AJAX function in versions up to, and including, 1.22.1. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to submit support request...

Affected:

up to 1.23.3

Fixed in:

1.23.3

Disclosed:

Apr 12, 2023

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.14.11.

Affected:

up to 1.14.12

Fixed in:

1.14.12

Disclosed:

Mar 16, 2023

CVE-2021-36821 on NVD →

[en] The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

Affected:

up to 1.15.4

Fixed in:

1.15.4

Disclosed:

Nov 23, 2021

CVE-2021-24700 on NVD →

The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

CVSS:

4.8

Affected:

up to 1.15.4

Fixed in:

1.15.4

Disclosed:

Oct 20, 2021

CVE-2021-24700 on NVD →

The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.14.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses...

CVSS:

7.2

Affected:

up to 1.14.12

Fixed in:

1.14.12

Disclosed:

Jul 14, 2021

CVE-2021-36821 on NVD →

The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.13.4. This is due to missing or incorrect nonce validation on the listen_for_saving_export_schedule() function. This makes it possible for unauthenticate...

CVSS:

5.4

Affected:

up to 1.13.5

Fixed in:

1.13.5

Disclosed:

Mar 1, 2021

CVE-2021-4417 on NVD →

Cross-Site Request Forgery (CSRF) vulnerability found by NintechNet in WordPress Forminator plugin (versions <= 1.14.8).

Affected:

up to 1.14.8.1

Fixed in:

1.14.8.1

Disclosed:

Mar 1, 2021

Cross-Site Request Forgery (CSRF) vulnerability found by Jerome Bruandet (NinTechNet) in WordPress Forminator plugin (versions <= 1.13.4).

Affected:

up to 1.13.5

Fixed in:

1.13.5

Disclosed:

Sep 16, 2020

[en] The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Mar 4, 2019

CVE-2019-9567 on NVD →

[en] The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] parameter if the attacker has the delete permission.

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Mar 4, 2019

CVE-2019-9568 on NVD →

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] parameter if the attacker has the delete permission.

CVSS:

6.5

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Feb 6, 2019

CVE-2019-9568 on NVD →

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.

CVSS:

6.1

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Feb 6, 2019

CVE-2019-9567 on NVD →

Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerability found by Tim Coen in WordPress Forminator plugin (versions <= 1.5.4).

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Feb 6, 2019

Authenticated Blind SQL Injection (SQLi) vulnerability found by Tim Coen in WordPress Forminator plugin (versions <= 1.5.4).

Affected:

up to 1.6

Fixed in:

1.6

Disclosed:

Feb 6, 2019

Affected:

up to 1.45.1

Fixed in:

1.45.1

CVE-2025-7638 on NVD →

Affected:

up to 1.44.3

Fixed in:

1.44.3

CVE-2025-6464 on NVD →

Affected:

up to 1.44.3

Fixed in:

1.44.3

CVE-2025-6463 on NVD →

Affected:

up to 1.44.2

Fixed in:

1.44.2

CVE-2025-5341 on NVD →

Affected:

up to 1.38.3

Fixed in:

1.38.3

CVE-2024-7052 on NVD →

Affected:

up to 1.42.1

Fixed in:

1.42.1

CVE-2025-3479 on NVD →

Affected:

up to 1.42.1

Fixed in:

1.42.1

CVE-2025-3487 on NVD →

Affected:

up to 1.39.3

Fixed in:

1.39.3

CVE-2025-0469 on NVD →

Affected:

up to 1.38.3

Fixed in:

1.38.3

CVE-2025-0470 on NVD →

Over 70 plugins and themes were vulnerable to Cross-Site Request Forgery due to improperly implemented nonce protection that could be bypassed.

Affected:

up to 1.14.8.1

Fixed in:

1.14.8.1

Multiple plugins did not properly check for CRSF nonces, allowing attackers to make logged in users do unwanted actions with crafted requests not containing the related nonce parameter. Other plugins reported in the original advisory which are not here have been added individually in the last weeks

Affected:

up to 1.14.8.1

Fixed in:

1.14.8.1