Forminator
WPMU DEV - Your All-in-One WordPress Platform
Developer
1.52.0
Latest version
600,000
Installations
No date
Last updated
Vulnerability history
0 present
30 patched
6 Mitigation rules
- Broken Access Control vulnerability<= 1.50.222/02/2026
- WordPress Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability<= 1.50.216/02/2026
- Missing Authorization to Authenticated (Forminator User+) CSV Export vulnerability<= 1.49.108/01/2026
- Authenticated (Administrator+) SQL Injection via `order_by` Parameter vulnerability<= 1.45.018/07/2025
- Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion vulnerability<= 1.44.201/07/2025
- Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion vulnerability<= 1.44.201/07/2025
- Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters vulnerability<= 1.44.105/06/2025
- Order Replay vulnerability<= 1.42.017/04/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' vulnerability<= 1.42.017/04/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability1.39.226/02/2025
- Admin+ Stored XSS vulnerability< 1.38.314/02/2025
- Reflected Cross-Site Scripting via Title Parameter vulnerability<= 1.38.230/01/2025
- Insecure Direct Object Reference to Submission Manipulation vulnerability<= 1.36.031/10/2024
- Missing Authorization to Authenticated Form Update and Creation vulnerability<= 1.35.128/10/2024
- Cross-Site Request Forgery to Draft Custom Form Creation vulnerability<= 1.35.116/10/2024
- Cross-Site Request Forgery to Draft Quiz Creation vulnerability<= 1.35.116/10/2024
- HubSpot Developer API Key Sensitive Information Exposure vulnerability<= 1.29.102/08/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode vulnerability<= 1.29.209/04/2024
- Unauthenticated Stored Cross-Site Scripting via File Upload vulnerability<= 1.29.001/04/2024
- Reflected Cross Site Scripting (XSS) vulnerability<= 1.29.025/03/2024
- Authenticated (Administrator+) Arbitrary File Upload vulnerability<= 1.27.015/11/2023
- Unauthenticated Arbitrary File Upload vulnerability<= 1.24.629/08/2023
- Unauth. Race Condition vulnerability< 1.24.104/07/2023
- Multiple Missing Authorization vulnerability<= 1.22.113/04/2023
- Stored Cross-Site Scripting (XSS) vulnerability<= 1.15.220/10/2021
- Stored Cross-Site Scripting (XSS) vulnerability<= 1.14.1114/07/2021
- Cross-Site Request Forgery (CSRF) vulnerability<= 1.14.801/03/2021
- Cross-Site Request Forgery (CSRF) vulnerability<= 1.13.416/09/2020
- Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerability<= 1.5.406/02/2019
- Authenticated Blind SQL Injection (SQLi) vulnerability<= 1.5.406/02/2019