wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

• CVE-2026-97638 High 7.5 Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter 0.6%
• CVE-2026-5461 Medium 6.5 Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata 0.3%
• CVE-2026-103911 Medium 6.5 Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block 0.3%
• CVE-2026-101335 Medium 6.5 Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags 0.3%
• CVE-2026-92144 High 7.2 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter 0.4%
• CVE-2026-85235 High 7.2 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field 0.3%
• CVE-2026-92229 Critical 9.1 Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter 0.7%
• CVE-2026-18324 High 7.2 Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field 0.5%
• CVE-2026-18328 High 7.2 Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter 0.4%
• CVE-2026-18323 High 7.2 Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) 0.5%
• CVE-2026-15748 Critical 9.8 Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration 4.1%
• CVE-2026-12998 Medium 5.3 Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter 0.5%
• CVE-2026-18325 High 7.2 Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field 0.5%
• CVE-2026-6214 Medium 6.5 Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook 0.4%
• CVE-2026-6222 Medium 5.3 Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter 0.4%
• CVE-2026-5192 High 7.5 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' 0.8%
• CVE-2026-2729 Medium 5.3 Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter 0.4%
• CVE-2026-2002 Medium 4.4 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting 0.2%
• CVE-2025-14782 Medium 5.3 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export 0.3%
• CVE-2025-7638 Medium 4.9 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter 0.3%
• CVE-2025-6464 High 7.5 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion 0.6%
• CVE-2025-6463 High 8.8 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion 15.1%
• CVE-2025-5341 Medium 6.4 Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters 0.3%
• CVE-2025-3479 Medium 5.3 Forminator <= 1.42.0 - Order Replay Vulnerability 0.2%
• CVE-2025-3487 Medium 6.4 Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' 0.3%
• CVE-2025-0469 Medium 6.4 Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting 0.3%
• CVE-2025-0470 Medium 6.1 Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter 0.3%
• CVE-2024-9700 Medium 5.3 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation 0.4%
• CVE-2024-10402 High 7.5 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation 0.5%
• CVE-2024-9351 Medium 4.3 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation 0.2%
• CVE-2024-9352 Medium 4.3 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation 0.2%
• CVE-2024-7389 High 7.5 Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure 0.7%
• CVE-2024-1794 High 7.2 Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload 0.5%
• CVE-2024-3053 Medium 6.4 Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode 0.4%
• CVE-2023-6133 Medium 6.6 Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload 0.9%
• CVE-2023-4596 Critical 9.8 Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload 14.3%
• CVE-2021-4417 Medium 5.4 Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass 0.4%