CVE-2025-6464

< 1.44.3

The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection

7.5HIGH

CVE-2025-6463

< 1.44.3

The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file delet

8.8HIGH

CVE-2024-45625

< 1.34.1

Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary

6.1MEDIUM

CVE-2024-7389

< 1.29.2

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 v

7.5HIGH

CVE-2024-31857

< 1.15.4

Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker ma

5.4MEDIUM

CVE-2024-31077

< 1.29.3

Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated atta

7.2HIGH

CVE-2024-28890

< 1.29.0

Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability. If this vulnerability is exp

5.3MEDIUM

CVE-2024-3053

< 1.29.3

The Forminator - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scriptin

6.4MEDIUM

CVE-2024-1794

<= 1.29.1

The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all vers

7.2HIGH

CVE-2024-29777

< 1.29.1

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One W

7.1HIGH

CVE-2023-5119

< 1.27.0

The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, w

4.8MEDIUM

CVE-2023-6133

<= 1.27.0

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_al

6.6MEDIUM

CVE-2023-4596

<= 1.24.6

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has

9.8CRITICAL

CVE-2023-3134

< 1.24.4

The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use

6.1MEDIUM

CVE-2021-4417

< 1.13.5

The Forminator - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery

5.4MEDIUM

CVE-2023-2010

< 1.24.1

The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then

3.1LOW

CVE-2021-36821

< 1.14.12

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator a

7.1HIGH

CVE-2021-24700

< 1.15.4

The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege

4.8MEDIUM

CVE-2019-9568

< 1.6

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?pa

6.5MEDIUM

CVE-2019-9567

< 1.6

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.

6.1MEDIUM