Plugin icon

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

forminator

Vulnerabilities:

32

Last Updated:

January 20, 2026

Active Installs:

600000

Published
Title
Fixed in
CVSS
Published
2026-01-08
Title
Forminator Forms < 1.49.2 - Forminator User+ CSV Export
Fixed in
Fixed in 1.49.2
CVSS
5.3 (medium)
Published
2025-07-17
Title
Forminator Forms < 1.45.1 - Admin+ SQLi
Fixed in
Fixed in 1.45.1
CVSS
4.9 (medium)
Published
2025-07-01
Title
Forminator Forms < 1.44.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion
Fixed in
Fixed in 1.44.3
CVSS
7.5 (high)
Published
2025-07-01
Title
Forminator Forms < 1.44.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion
Fixed in
Fixed in 1.44.3
CVSS
7.5 (high)
Published
2025-06-04
Title
Forminator < 1.44.2 - Contributor+ Stored DOM-Based XSS via id and data-size Parameters
Fixed in
Fixed in 1.44.2
CVSS
5.9 (medium)
Published
2025-04-16
Title
Forminator < 1.42.1 - Order Replay Vulnerability
Fixed in
Fixed in 1.42.1
CVSS
5.3 (medium)
Published
2025-04-16
Title
Forminator < 1.42.1 - Contributor+ Stored XSS via 'limit'
Fixed in
Fixed in 1.42.1
CVSS
5.9 (medium)
Published
2025-02-26
Title
Forminator < 1.39.3 - Contributor+ Stored Cross-Site Scripting
Fixed in
Fixed in 1.39.3
CVSS
6.4 (medium)
Published
2025-01-30
Title
Forminator < 1.38.3 - Reflected XSS via Title Parameter
Fixed in
Fixed in 1.38.3
CVSS
7.1 (high)
Published
2025-01-24
Title
Forminator < 1.38.3 - Admin+ Stored XSS
Fixed in
Fixed in 1.38.3
CVSS
3.5 (low)
Published
2024-10-30
Title
Forminator Forms < 1.36.1 - Unauthenticated Arbitrary Quiz Submissions Update
Fixed in
Fixed in 1.36.1
CVSS
5.3 (medium)
Published
2024-10-25
Title
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.36.0 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation
Fixed in
Fixed in 1.36.0
CVSS
7.5 (high)
Published
2024-10-16
Title
Forminator Forms < 1.36.0 - Draft Custom Form Creation via CSRF
Fixed in
Fixed in 1.36.0
CVSS
4.3 (medium)
Published
2024-10-16
Title
Forminator Forms < 1.36.0 - Draft Quiz Creation via CSRF
Fixed in
Fixed in 1.36.0
CVSS
4.3 (medium)
Published
2024-09-09
Title
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.34.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.34.1
CVSS
6.1 (medium)
Published
2024-08-01
Title
Forminator < 1.29.2 - HubSpot Developer API Key Sensitive Information Exposure
Fixed in
Fixed in 1.29.2
CVSS
7.5 (high)
Published
2024-04-18
Title
Forminator < 1.29.0 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 1.29.0
CVSS
9.8 (critical)
Published
2024-04-18
Title
Forminator < 1.29.3 - Admin+ SQL Injection
Fixed in
Fixed in 1.29.3
CVSS
4.1 (medium)
Published
2024-04-18
Title
Forminator < 1.15.4 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.15.4
CVSS
4.1 (medium)
Published
2024-04-08
Title
Forminator < 1.29.3 - Contributor+ Stored Cross-Site Scripting via forminator_form Shortcode
Fixed in
Fixed in 1.29.3
CVSS
6.4 (medium)
Published
2024-03-29
Title
Forminator < 1.29.1 - Unauthenticated Stored XSS
Fixed in
Fixed in 1.29.1
CVSS
7.2 (high)
Published
2024-03-25
Title
Forminator < 1.29.1 - Reflected Cross-Site Scripting
Fixed in
Fixed in 1.29.1
CVSS
7.1 (high)
Published
2023-11-14
Title
Forminator < 1.28.0 - Admin+ Arbitrary File Upload
Fixed in
Fixed in 1.28.0
CVSS
4.1 (medium)
Published
2023-10-27
Title
Forminator and Forminator Pro < 1.27.0 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 1.27.0
CVSS
3.4 (low)
Published
2023-08-04
Title
Forminator < 1.25.0 - Unauthenticated Arbitrary File Upload
Fixed in
Fixed in 1.25.0
CVSS
9.8 (critical)
Published
2023-07-10
Title
Forminator < 1.24.4 - Reflected XSS
Fixed in
Fixed in 1.24.4
CVSS
7.1 (high)
Published
2023-06-12
Title
Forminator < 1.24.1 - Unauthenticated Race Condition on poll vote
Fixed in
Fixed in 1.24.1
CVSS
5.3 (medium)
Published
2021-10-20
Title
Forminator < 1.15.4 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 1.15.4
CVSS
3.5 (low)
Published
2021-07-14
Title
Forminator < 1.14.12 - Unauthenticated Stored XSS
Fixed in
Fixed in 1.14.12
CVSS
8.8 (high)
Published
2021-03-01
Title
Multiple Plugins - CSRF Nonce Bypasses
Fixed in
Fixed in 1.14.8.1
CVSS
5.4 (medium)
Published
2020-09-16
Title
Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 1.13.5
CVSS
5.4 (medium)
Published
2019-02-06
Title
Forminator < 1.6 - Authenticated Multiple Vulnerabilities
Fixed in
Fixed in 1.6
CVSS
6.5 (medium)