Wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
31 CVEs affecting Wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder. Latest disclosed: 2026-09-19. Critical: 3, High: 10.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15748 | Critical | 9.8 | 2026-08-18 | The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload functi… |
CVE-2023-4596 | Critical | 9.8 | 2023-08-30 | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server… |
CVE-2026-92229 | Critical | 9.1 | 2026-09-19 | The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions… |
CVE-2025-6463 | High | 8.8 | 2025-07-02 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file… |
CVE-2026-5192 | High | 7.5 | 2026-05-05 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including… |
CVE-2025-6464 | High | 7.5 | 2025-07-02 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and i… |
CVE-2024-10402 | High | 7.5 | 2024-10-26 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability c… |
CVE-2024-7389 | High | 7.5 | 2024-08-02 | The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hub… |
CVE-2026-18324 | High | 7.2 | 2026-08-28 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textare… |
CVE-2026-18328 | High | 7.2 | 2026-08-25 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the… |
CVE-2026-18323 | High | 7.2 | 2026-08-25 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save… |
CVE-2026-18325 | High | 7.2 | 2026-08-06 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Rec… |
CVE-2024-1794 | High | 7.2 | 2024-04-09 | The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and including, 1… |
CVE-2023-6133 | Medium | 6.6 | 2023-11-15 | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in… |
CVE-2026-6214 | Medium | 6.5 | 2026-05-07 | The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_e… |
CVE-2025-5341 | Medium | 6.4 | 2025-06-05 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'dat… |
CVE-2025-3487 | Medium | 6.4 | 2025-04-17 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ param… |
CVE-2025-0469 | Medium | 6.4 | 2025-02-27 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider templa… |
CVE-2024-3053 | Medium | 6.4 | 2024-04-09 | The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ forminator_for… |
CVE-2025-0470 | Medium | 6.1 | 2025-01-31 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title para… |