Forminator Forms - Contact Form, Payment Form & Custom Form Builder vulnerabilities

Known security issues in the Forminator Forms - Contact Form, Payment Form & Custom Form Builder WordPress plugin, by affected version, with severity, CVE and the version that fixes each one.

Plugin slug: forminator
Latest version: 1.58.2
Active installs: 600,000+
Known vulnerabilities: 83
Data updated: 2026-10-17 06:29 UTC

View on wordpress.org

Check your version

This information comes from public vulnerability databases and may be incomplete or out of date. A plugin with no known vulnerabilities is not proof that it is secure; keep plugins updated and remove the ones you do not use.

Fixed in version 1.58.2 (2)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.58.2
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags CVE-2026-101335 · Source	Medium	6.5	< 1.58.2	2026-10-15
Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block CVE-2026-103911 · Source	Medium	6.5	< 1.58.2	2026-10-15

Fixed in version 1.58.1 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.58.1
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.58.0 - Missing Authorization CVE-2026-108486 · Source	Medium	5.3	< 1.58.1	2026-10-08

Fixed in version 1.58.0 (4)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.58.0
Vulnerability	Severity	CVSS	Affected versions	Published
[en] Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3. CVE-2026-96341 · Source	High	8.2	< 1.58.0	2026-10-10
[en] Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions. CVE-2026-65459 · Source	High	7.5	< 1.58.0	2026-10-10
[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3. CVE-2026-102388 · Source	High	7.1	< 1.58.0	2026-10-10
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.3 - Cross-Site Request Forgery CVE-2026-106611 · Source	High	7.1	< 1.58.0	2026-10-02

Fixed in version 1.57.3 (2)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.57.3
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter CVE-2026-92229 · Source	Critical	9.1	< 1.57.3	2026-08-28
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.2 - Missing Authorization CVE-2026-96335 · Source	High	7.5	< 1.57.3	2026-10-07

Fixed in version 1.57.2.1 (9)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.57.2.1
Vulnerability	Severity	CVSS	Affected versions	Published
[en] Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: from n/a through 1.57.2. CVE-2026-96336 · Source	High	7.5	< 1.57.2.1	2026-10-09
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field CVE-2026-85235 · Source	High	7.2	< 1.57.2.1	2026-09-30
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter CVE-2026-92144 · Source	High	7.2	< 1.57.2.1	2026-09-30
Forminator Forms <= 1.57.2.0 - Unauthenticated Poll Vote Limit Bypass CVE-2026-87070 · Source	Medium	5.3	< 1.57.2.1	2026-09-21
Forminator Forms <= 1.57.2.0 - Missing Authorization to Unauthenticated Arbitrary Post Meta Injection CVE-2026-87071 · Source	Medium	5.3	< 1.57.2.1	2026-09-21
Forminator Forms <= 1.57.2.0 - Missing Authorization CVE-2026-87069 · Source	Not rated	-	< 1.57.2.1	2026-09-21
Forminator Forms <= 1.57.2.0 - Missing Authorization CVE-2026-87074 · Source	Not rated	-	< 1.57.2.1	2026-09-21
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection CVE-2026-87067 · Source	Not rated	-	< 1.57.2.1	2026-09-18
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) Privilege Escalation CVE-2026-87068 · Source	Not rated	-	< 1.57.2.1	2026-09-18

Fixed in version 1.57.2 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.57.2
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.1 - Unauthenticated Payment Bypass CVE-2026-82220 · Source	Medium	5.3	< 1.57.2	2026-08-28

Fixed in version 1.57.1 (2)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.57.1
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.0 - Unauthenticated PHP Object Injection CVE-2026-66583 · Source	Critical	9.8	< 1.57.1	2026-08-20
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.1 - Unauthenticated Privilege Escalation CVE-2026-19220 · Source	Not rated	-	< 1.57.1	2026-08-26

Fixed in version 1.57.0.7 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.57.0.7
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.7 - Authenticated (Custom Role+) Privilege Escalation CVE-2026-19222 · Source	Not rated	-	< 1.57.0.7	2026-08-22

Fixed in version 1.57.0.5 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.57.0.5
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.5 - Authenticated (Administrator+) Remote Code Execution CVE-2026-19221 · Source	Not rated	-	< 1.57.0.5	2026-08-22

Fixed in version 1.57.0.3 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.57.0.3
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) CVE-2026-18323 · Source	High	7.2	< 1.57.0.3	2026-08-24

Fixed in version 1.57.0.2 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.57.0.2
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field CVE-2026-18324 · Source	High	7.2	< 1.57.0.2	2026-08-24

Fixed in version 1.57.0.1 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.57.0.1
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter CVE-2026-18328 · Source	High	7.2	< 1.57.0.1	2026-08-24

Fixed in version 1.56.2 (2)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.56.2
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration CVE-2026-15748 · Source	Critical	9.8	< 1.56.2	2026-08-18
Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field CVE-2026-18325 · Source	High	7.2	< 1.56.2	2026-08-05

Fixed in version 1.56.1 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.56.1
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.56.0 - Unauthenticated Stored Cross-Site Scripting CVE-2026-28143 · Source	High	7.1	< 1.56.1	2026-08-03

Fixed in version 1.56.0.1 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.56.0.1
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.56.0 - Authenticated (Contributor+) Privilege Escalation CVE-2026-28111 · Source	High	8.8	< 1.56.0.1	2026-08-03

Fixed in version 1.55.1 (2)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.55.1
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.2 - Unauthenticated Arbitrary File Download CVE-2026-57815 · Source	High	7.5	< 1.55.1	2026-07-08
Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter CVE-2026-12998 · Source	Medium	5.3	< 1.55.1	2026-08-15

Fixed in version 1.55.0.2 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.55.0.2
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.1 - Unauthenticated Stored Cross-Site Scripting CVE-2026-57814 · Source	High	7.1	< 1.55.0.2	2026-07-08

Fixed in version 1.53.2 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.53.2
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.53.1 - Unauthenticated Stored Cross-Site Scripting CVE-2026-56071 · Source	High	7.1	< 1.53.2	2026-06-24

Fixed in version 1.53.0.1 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.53.0.1
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook CVE-2026-6214 · Source	Medium	6.5	< 1.53.0.1	2026-05-06

Fixed in version 1.52.2 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.52.2
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' CVE-2026-5192 · Source	High	7.5	< 1.52.2	2026-05-04

Fixed in version 1.52.1 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.52.1
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter CVE-2026-2729 · Source	Medium	5.3	< 1.52.1	2026-05-04

Fixed in version 1.52 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.52
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter CVE-2026-6222 · Source	Medium	5.3	< 1.52	2026-05-06

Fixed in version 1.50.3 (2)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.50.3
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator <= 1.50.2 - Missing Authorization CVE-2026-32409 · Source	Medium	5.3	< 1.50.3	2026-02-22
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2026-2002 · Source	Not rated	-	< 1.50.3	0000-00-00

Fixed in version 1.49.2 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.49.2
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export CVE-2025-14782 · Source	Medium	5.3	< 1.49.2	2026-01-08

Fixed in version 1.45.1 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.45.1
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter CVE-2025-7638 · Source	Medium	4.9	< 1.45.1	0000-00-00

Fixed in version 1.44.3 (2)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.44.3
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion CVE-2025-6463 · Source	High	8.8	< 1.44.3	0000-00-00
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion CVE-2025-6464 · Source	High	8.8	< 1.44.3	0000-00-00

Fixed in version 1.44.2 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.44.2
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters CVE-2025-5341 · Source	Medium	6.4	< 1.44.2	0000-00-00

Fixed in version 1.42.1 (2)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.42.1
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' CVE-2025-3487 · Source	Medium	5.4	< 1.42.1	0000-00-00
Forminator <= 1.42.0 - Order Replay Vulnerability CVE-2025-3479 · Source	Medium	5.3	< 1.42.1	0000-00-00

Fixed in version 1.39.3 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.39.3
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-0469 · Source	Medium	5.4	< 1.39.3	0000-00-00

Fixed in version 1.38.3 (2)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.38.3
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter CVE-2025-0470 · Source	Medium	6.1	< 1.38.3	0000-00-00
Forminator < 1.38.3 - Admin+ Stored XSS CVE-2024-7052 · Source	Medium	4.8	< 1.38.3	0000-00-00

Fixed in version 1.36.1 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.36.1
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation CVE-2024-9700 · Source	Medium	5.3	< 1.36.1	2024-10-30

Fixed in version 1.36.0 (3)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.36.0
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation CVE-2024-10402 · Source	High	7.5	< 1.36.0	2024-10-25
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation CVE-2024-9352 · Source	Medium	4.3	< 1.36.0	2024-10-16
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation CVE-2024-9351 · Source	Medium	4.3	< 1.36.0	2024-10-16

Fixed in version 1.34.1 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.34.1
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.34.0 - Reflected Cross-Site Scripting CVE-2024-45625 · Source	Medium	6.1	< 1.34.1	2024-09-09

Fixed in version 1.29.3 (2)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.29.3
Vulnerability	Severity	CVSS	Affected versions	Published
[en] Forminator prior to 1.29.3 contains a SQL injection vulnerability. CVE-2024-31077 · Source	High	7.2	< 1.29.3	2024-04-23
Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode CVE-2024-3053 · Source	Medium	5.4	< 1.29.3	2024-04-08

Fixed in version 1.29.2 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.29.2
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure CVE-2024-7389 · Source	High	7.5	< 1.29.2	2024-08-01

Fixed in version 1.29.1 (2)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.29.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Forminator Plugin <= 1.29.0 is vulnerable to Cross Site Scripting (XSS) CVE-2024-29777 · Source	High	7.1	< 1.29.1	2024-03-25
Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload CVE-2024-1794 · Source	Medium	6.1	< 1.29.1	2024-03-29

Fixed in version 1.29.0 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.29.0
Vulnerability	Severity	CVSS	Affected versions	Published
Multiple vulnerabilities in WordPress Plugin "Forminator" CVE-2024-28890 · Source	Medium	5.3	< 1.29.0	2024-04-18

Fixed in version 1.28.0 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.28.0
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload CVE-2023-6133 · Source	Medium	4.9	< 1.28.0	2023-11-14

Fixed in version 1.27.0 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.27.0
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.27.0 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2023-5119 · Source	Medium	4.8	< 1.27.0	2023-10-27

Fixed in version 1.25.0 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.25.0
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload CVE-2023-4596 · Source	Critical	9.8	< 1.25.0	2023-08-29

Fixed in version 1.24.4 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.24.4
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator <= 1.24.1 - Reflected Cross-Site Scripting CVE-2023-3134 · Source	Medium	6.1	< 1.24.4	2023-07-10

Fixed in version 1.24.1 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.24.1
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Forminator Plugin < 1.24.1 is vulnerable to Race Condition CVE-2023-2010 · Source	Low	3.1	< 1.24.1	2023-06-12

Fixed in version 1.23.3 (4)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.23.3
Vulnerability	Severity	CVSS	Affected versions	Published
WordPress Forminator Plugin <= 1.22.1 is vulnerable to Broken Access Control No CVE assigned · Source	Not rated	-	< 1.23.3	2023-04-13
Forminator <= 1.22.1 - Missing Authorization on 'load_hcaptcha_preview' AJAX function No CVE assigned · Source	Not rated	-	< 1.23.3	2023-04-12
Forminator <= 1.22.1 - Missing Authorization on 'load_recaptcha_preview' AJAX function No CVE assigned · Source	Not rated	-	< 1.23.3	2023-04-12
Forminator <= 1.22.1 - Missing Authorization on 'hubspot_support_request' AJAX function No CVE assigned · Source	Not rated	-	< 1.23.3	2023-04-12

Fixed in version 1.15.4 (2)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.15.4
Vulnerability	Severity	CVSS	Affected versions	Published
[en] Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. CVE-2024-31857 · Source	Medium	5.4	< 1.15.4	2024-04-23
WordPress Forminator plugin <= 1.15.2 - Stored Cross-Site Scripting (XSS) vulnerability CVE-2021-24700 · Source	Medium	4.8	< 1.15.4	2021-10-20

Fixed in version 1.14.12 (1)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.14.12
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator <= 1.14.11 - Unauthenticated Stored Cross-Site Scripting CVE-2021-36821 · Source	Medium	6.1	< 1.14.12	2021-07-14

Fixed in version 1.14.8.1 (4)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.14.8.1
Vulnerability	Severity	CVSS	Affected versions	Published
CVE split into individual CVE IDs for each software record. CVE-2021-4342 · Source	Low	0.0	< 1.14.8.1	2023-06-07
WordPress Forminator plugin <= 1.14.8 - Cross-Site Request Forgery (CSRF) vulnerability No CVE assigned · Source	Not rated	-	< 1.14.8.1	2021-03-01
Multiple Plugins - CSRF Nonce Bypasses No CVE assigned · Source	Not rated	-	< 1.14.8.1	-
404 Page Not Found No CVE assigned · Source	Not rated	-	< 1.14.8.1	-

Fixed in version 1.13.5 (2)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.13.5
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass CVE-2021-4417 · Source	Medium	4.3	< 1.13.5	2021-03-01
WordPress Forminator plugin <= 1.13.4 - Cross-Site Request Forgery (CSRF) vulnerability No CVE assigned · Source	Not rated	-	< 1.13.5	2020-09-16

Fixed in version 1.6 (4)

Forminator Forms - Contact Form, Payment Form & Custom Form Builder: Fixed in version 1.6
Vulnerability	Severity	CVSS	Affected versions	Published
Forminator Plugin <= 1.5.3.1 - SQL Injection CVE-2019-9568 · Source	Medium	6.5	< 1.6	2019-02-06
Forminator Plugin <= 1.5.4 - Cross-Site Scripting CVE-2019-9567 · Source	Medium	6.1	< 1.6	2019-02-06
WordPress Forminator plugin <= 1.5.4 - Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerability No CVE assigned · Source	Not rated	-	< 1.6	2019-02-06
WordPress Forminator plugin <= 1.5.4 - Authenticated Blind SQL Injection (SQLi) vulnerability No CVE assigned · Source	Not rated	-	< 1.6	2019-02-06

Check every plugin on your site automatically

Install the free Webforta WordPress Security plugin and Webforta matches every plugin, theme and WordPress version you run against known vulnerabilities, and tells you when a new one affects your site.

Start free About the WordPress plugin

Sources and attribution

Vulnerability data from WPVulnerability (WordPress, plugins, themes and server software). WPVulnerability data license.
CVE records are copyright The MITRE Corporation. CVE Terms of Use.
Known-exploited status from the CISA Known Exploited Vulnerabilities catalog. Public domain (U.S. Government work).
Plugin names, latest versions and install counts from the WordPress.org plugin directory. WordPress is a trademark of the WordPress Foundation; Webforta is not affiliated with or endorsed by WordPress.org, WPVulnerability or the sources above.