FO
Product
Forminator
21
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 5Medium 14Low 1
Watch
Add Forminator to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-4596 | 9.8 | Aug 30 | Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload Affected: through 1.24.6 |
| CVE-2025-6464 | 8.8 | Jul 2 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion Affected: before 1.44.3 |
| CVE-2025-6463 | 8.8 | Jul 2 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion Affected: before 1.44.3 |
| CVE-2024-10402 | 8.8 | Oct 26 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation Affected: through 1.35.1 |
| CVE-2024-7389 | 7.5 | Aug 2 | Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure Affected: before 1.29.2; before 1.29.2 |
| CVE-2024-31077 | 7.2 | Apr 23 | Forminator prior to 1.29.3 contains a SQL injection vulnerability Affected: before 1.29.3 |
| CVE-2019-9568 | 6.5 | Mar 4 | The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=forminator-entries entry[] parameter if the… Affected: before 1.6 |
| CVE-2024-45625 | 6.1 | Sep 9 | Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1 Affected: before 1.34.1 |
| CVE-2024-1794 | 6.1 | Apr 9 | Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload Affected: through 1.29.1; through 1.29.1 |
| CVE-2024-29777 | 6.1 | Mar 27 | WordPress Forminator plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability Affected: before 1.29.1; before 1.29.1 |
| CVE-2023-3134 | 6.1 | Jul 31 | Forminator < 1.24.4 - Reflected XSS Affected: before 1.24.4 |
| CVE-2021-36821 | 6.1 | Mar 16 | WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability Affected: before 1.14.12 |
| CVE-2019-9567 | 6.1 | Mar 4 | The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll Affected: before 1.6 |
| CVE-2024-31857 | 5.4 | Apr 23 | Forminator prior to 1.15.4 contains a cross-site scripting vulnerability Affected: before 1.15.4 |
| CVE-2024-3053 | 5.4 | Apr 9 | Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode Affected: before 1.29.3 |
| CVE-2024-28890 | 5.3 | Apr 23 | Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability Affected: before 1.29.0 |
| CVE-2023-6133 | 4.9 | Nov 15 | Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload Affected: through 1.27.0 |
| CVE-2023-5119 | 4.8 | Nov 20 | Forminator and Forminator Pro < 1.27.0 - Admin+ Stored Cross-Site Scripting Affected: before 1.27.0 |
| CVE-2021-24700 | 4.8 | Nov 23 | Forminator < 1.15.4 - Admin+ Stored Cross-Site Scripting Affected: before 1.15.4 |
| CVE-2021-4417 | 4.3 | Jul 12 | Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass Affected: before 1.13.5 |
| CVE-2023-2010 | 3.1 | Jul 4 | Forminator < 1.24.1 - Unauthenticated Race Condition on poll vote Affected: before 1.24.1 |
Showing 21