WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
forminator
Published
2024-10-16
Title
Forminator Forms < 1.36.0 - Draft Custom Form Creation via CSRF
Slug
forminator
Published
2024-10-25
Title
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.36.0 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation
Slug
forminator
Published
2024-10-30
Title
Forminator Forms < 1.36.1 - Unauthenticated Arbitrary Quiz Submissions Update
Slug
forminator
Published
2025-01-24
Title
Forminator < 1.38.3 - Admin+ Stored XSS
Slug
forminator
Published
2025-01-30
Title
Forminator < 1.38.3 - Reflected XSS via Title Parameter
Slug
forminator
Published
2025-02-26
Title
Forminator < 1.39.3 - Contributor+ Stored Cross-Site Scripting
Slug
forminator
Published
2025-04-16
Title
Forminator < 1.42.1 - Contributor+ Stored XSS via 'limit'
Slug
forminator
Published
2025-04-16
Title
Forminator < 1.42.1 - Order Replay Vulnerability
Slug
forminator
Published
2025-06-04
Title
Forminator < 1.44.2 - Contributor+ Stored DOM-Based XSS via id and data-size Parameters
Slug
forminator
Published
2025-07-01
Title
Forminator Forms < 1.44.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion
Slug
forminator
Published
2025-07-01
Title
Forminator Forms < 1.44.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion
Slug
forminator
Published
2025-07-17
Title
Forminator Forms < 1.45.1 - Admin+ SQLi
Slug
forminator
Published
2026-01-08
Title
Forminator Forms < 1.49.2 - Forminator User+ CSV Export
Slug
forminator
Published
2026-02-16
Title
Forminator Forms < 1.50.3 - Admin+ Stored XSS
Slug
forminator
Published
2026-02-22
Title
Forminator < 1.50.3 - Missing Authorization
Slug
formlift
Published
2024-07-19
Title
FormLift for Infusionsoft Web Forms < 7.5.18 - Unauthenticated SQL Injection
Slug
formlift
Published
2025-03-28
Title
FormLift for Infusionsoft Web Forms < 7.5.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
formlift
Published
2025-06-18
Title
FormLift for Infusionsoft Web Forms < 7.5.21 - Reflected Cross-Site Scripting
Slug
formlift
Published
2026-03-25
Title
FormLift for Infusionsoft Web Forms < 7.5.22 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow
Slug
forms-3rdparty-post-again
Published
2024-11-04
Title
Forms: 3rd-Party Post Again <= 0.3 - Reflected Cross-Site Scripting
Slug
forms-ada-form-builder
Published
2023-04-24
Title
Forms Ada <= 1.0 - Unauthenticated Reflected XSS
Slug
forms-bridge
Published
2026-01-27
Title
Forms Bridge < 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Slug
forms-by-made-it
Published
2021-07-03
Title
Forms < 1.12.3 - Authenticated Stored Cross-Site Scripting (XSS)
Slug
forms-by-made-it
Published
2024-11-08
Title
Forms < 2.8.1 - Unauthenticated Arbitrary File Upload
Slug
forms-by-made-it
Published
2025-08-13
Title
Forms <= 2.9.0 - Authenticated (Contributor+) Arbitrary File Upload