Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter
Critical
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) Privilege Escalation
High
Forminator Forms <= 1.57.2.0 - Authenticated (Admin+) PHP Object Injection
Medium
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.1 - Unauthenticated Privilege Escalation
High
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.7 - Authenticated (Custom Role+) Privilege Escalation
Medium
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.1 - Unauthenticated Payment Bypass
Medium
Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
High
Forminator Forms – Contact Form, Payment Form & Custom Form Builder < 1.57.0.5 - Authenticated (Administrator+) Remote Code Execution
High
Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
High
Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
High
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.57.0 - Unauthenticated PHP Object Injection
High
Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration
Critical
Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter
Medium
Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field
High
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.56.0 - Unauthenticated Stored Cross-Site Scripting
High
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.56.0 - Authenticated (Contributor+) Privilege Escalation
High
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.1 - Unauthenticated Stored Cross-Site Scripting
High
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.2 - Unauthenticated Arbitrary File Download
High
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.53.1 - Unauthenticated Stored Cross-Site Scripting
High
Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook
Medium
Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter
Medium
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'
High
Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter
Medium
Forminator <= 1.50.2 - Missing Authorization
Medium
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export
Medium
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter
Medium
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion
High
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion
High
Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters
Medium
Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'
Medium
Forminator <= 1.42.0 - Order Replay Vulnerability
Medium
Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter
Medium
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.38.2 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation
Medium
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation
High
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation
Medium
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation
Medium
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.34.0 - Reflected Cross-Site Scripting
Medium
Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure
High
Forminator <= 1.29.2 - Authenticated (Admin+) SQL Injection
Critical
Forminator <= 1.15.2 - Reflected Cross-Site Scripting
Medium
Forminator <= 1.28.1 - Unauthenticated Arbitrary File Upload
Critical
Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode
Medium
Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload
High
Forminator <= 1.29.0 - Reflected Cross-Site Scripting
Medium
Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload
Medium
Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.27.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload
Critical
Forminator <= 1.24.1 - Reflected Cross-Site Scripting
Medium
Forminator <= 1.23.3 - Race Condition to Multiple Poll Voting
Medium
Forminator <= 1.22.1 - Missing Authorization on 'load_hcaptcha_preview' AJAX function
Medium
April 12, 2023
Patched in ["1.23.3"]
Forminator <= 1.22.1 - Missing Authorization on 'load_recaptcha_preview' AJAX function
Medium
April 12, 2023
Patched in ["1.23.3"]
Forminator <= 1.22.1 - Missing Authorization on 'hubspot_support_request' AJAX function
Medium
April 12, 2023
Patched in ["1.23.3"]
Forminator <= 1.15.2 - Admin+ Stored Cross-Site Scripting
Medium
Forminator <= 1.14.11 - Unauthenticated Stored Cross-Site Scripting
High
Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass
Medium
Forminator Plugin <= 1.5.4 - Cross-Site Scripting
Medium
Forminator Plugin <= 1.5.3.1 - SQL Injection
Medium
