Incsub Forminator vulnerabilities

• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion CVE-2025-6464 7.5 HighJuly 2, 2025
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion CVE-2025-6463 EPSS 15.1% 8.8 HighJuly 2, 2025
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +2 more Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation CVE-2024-10402 7.5 HighOctober 26, 2024
• incsub forminator Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this... CVE-2024-45625 6.1 MediumSeptember 9, 2024
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure CVE-2024-7389 7.5 HighAugust 2, 2024
• incsub forminator, wpmudev broken link checker +1 more Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type... CVE-2024-28890 5.3 MediumApril 23, 2024
• incsub forminator Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is... CVE-2024-31077 EPSS 30.4% 7.2 HighApril 23, 2024
• incsub forminator Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability... CVE-2024-31857 5.4 MediumApril 23, 2024
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload CVE-2024-1794 7.2 HighApril 9, 2024
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode CVE-2024-3053 6.4 MediumApril 9, 2024
• incsub forminator WordPress Forminator plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability CVE-2024-29777 7.1 HighMarch 27, 2024
• incsub forminator Forminator and Forminator Pro < 1.27.0 - Admin+ Stored Cross-Site Scripting CVE-2023-5119 4.8 MediumNovember 20, 2023
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload CVE-2023-6133 6.6 MediumNovember 15, 2023
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload CVE-2023-4596 Public exploit EPSS 14.3% 9.8 CriticalAugust 30, 2023
• incsub forminator Forminator < 1.24.4 - Reflected XSS CVE-2023-3134 6.1 MediumJuly 31, 2023
• incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 more Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass CVE-2021-4417 5.4 MediumJuly 12, 2023
• incsub forminator Forminator < 1.24.1 - Unauthenticated Race Condition on poll vote CVE-2023-2010 3.1 LowJuly 4, 2023
• incsub forminator WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability CVE-2021-36821 7.1 HighMarch 16, 2023
• incsub forminator, unknown forminator – contact form, payment form & custom form builder +1 more Forminator < 1.15.4 - Admin+ Stored Cross-Site Scripting CVE-2021-24700 4.8 MediumNovember 23, 2021
• incsub forminator The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL... CVE-2019-9568 6.5 MediumMarch 4, 2019
• incsub forminator The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a... CVE-2019-9567 6.1 MediumMarch 4, 2019