Skip to contentWpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder vulnerabilities
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' ParameterCVE-2026-976387.5 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload MetadataCVE-2026-54616.5 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_blockCVE-2026-1039116.5 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge TagsCVE-2026-1013356.5 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' ParameterCVE-2026-921447.2 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea FieldCVE-2026-852357.2 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' ParameterCVE-2026-92229Public exploit9.1 Critical
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea FieldCVE-2026-183247.2 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' ParameterCVE-2026-183287.2 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)CVE-2026-183237.2 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field ConfigurationCVE-2026-15748Public exploit9.8 Critical
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' ParameterCVE-2026-129985.3 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select FieldCVE-2026-183257.2 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded HookCVE-2026-62146.5 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' ParameterCVE-2026-62225.3 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'CVE-2026-51927.5 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' ParameterCVE-2026-27295.3 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site ScriptingCVE-2026-2002Public exploit4.4 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV ExportCVE-2025-147825.3 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` ParameterCVE-2025-76384.9 Medium
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission DeletionCVE-2025-64647.5 High
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission DeletionCVE-2025-6463EPSS 15.1%8.8 High
- wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 moreForminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size ParametersCVE-2025-53416.4 Medium
- wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 moreForminator <= 1.42.0 - Order Replay VulnerabilityCVE-2025-34795.3 Medium
- wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 moreForminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'CVE-2025-34876.4 Medium
- wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 moreForminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingCVE-2025-04696.4 Medium
- wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 moreForminator <= 1.38.2 - Reflected Cross-Site Scripting via Title ParameterCVE-2025-04706.1 Medium
- wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 moreForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission ManipulationCVE-2024-97005.3 Medium
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +2 moreForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and CreationCVE-2024-104027.5 High
- wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 moreForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz CreationCVE-2024-93514.3 Medium
- wpmudev forminator forms – contact form, payment form & custom form builder, forminator forms +1 moreForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form CreationCVE-2024-93524.3 Medium
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information ExposureCVE-2024-73897.5 High
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File UploadCVE-2024-17947.2 High
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form ShortcodeCVE-2024-30536.4 Medium
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File UploadCVE-2023-61336.6 Medium
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator <= 1.24.6 - Unauthenticated Arbitrary File UploadCVE-2023-4596Public exploitEPSS 14.3%9.8 Critical
- incsub forminator, wpmudev forminator forms – contact form, payment form & custom form builder +1 moreForminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery BypassCVE-2021-44175.4 Medium