Wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
37 CVEs affecting Wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder. Latest disclosed: 2026-10-30. Critical: 3, High: 13.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15748 | Critical | 9.8 | 2026-08-18 | The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload functi… |
CVE-2023-4596 | Critical | 9.8 | 2023-08-30 | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server… |
CVE-2026-92229 | Critical | 9.1 | 2026-09-19 | The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions… |
CVE-2025-6463 | High | 8.8 | 2025-07-02 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file… |
CVE-2026-97638 | High | 7.5 | 2026-10-30 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2026-5192 | High | 7.5 | 2026-05-05 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including… |
CVE-2025-6464 | High | 7.5 | 2025-07-02 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and i… |
CVE-2024-10402 | High | 7.5 | 2024-10-26 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability c… |
CVE-2024-7389 | High | 7.5 | 2024-08-02 | The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hub… |
CVE-2026-92144 | High | 7.2 | 2026-10-01 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-… |
CVE-2026-85235 | High | 7.2 | 2026-10-01 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textare… |
CVE-2026-18324 | High | 7.2 | 2026-08-28 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textare… |
CVE-2026-18328 | High | 7.2 | 2026-08-25 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the… |
CVE-2026-18323 | High | 7.2 | 2026-08-25 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save… |
CVE-2026-18325 | High | 7.2 | 2026-08-06 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Rec… |
CVE-2024-1794 | High | 7.2 | 2024-04-09 | The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and including, 1… |
CVE-2023-6133 | Medium | 6.6 | 2023-11-15 | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in… |
CVE-2026-5461 | Medium | 6.5 | 2026-10-30 | The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin acce… |
CVE-2026-103911 | Medium | 6.5 | 2026-10-16 | The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions… |
CVE-2026-101335 | Medium | 6.5 | 2026-10-16 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to… |