Forminator
WPMU DEV - Your All-in-One WordPress Platform
Developer
1.57.1
Latest version
600,000
Installations
No date
Last updated
Vulnerability history
0 present
43 patched
16 Mitigation rules
- PHP Object Injection vulnerability<= 1.57.06 days ago
- Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter vulnerability<= 1.55.0.27 days ago
- Unauth. Arbitrary File Upload<= 1.56.17 days ago
- Unauthenticated Stored Cross-Site Scripting vulnerability<= 1.56.106/08/2026
- Cross Site Scripting (XSS) vulnerability<= 1.56.003/08/2026
- Privilege Escalation vulnerability<= 1.56.003/08/2026
- Cross Site Scripting (XSS) vulnerability<= 1.55.0.108/07/2026
- Arbitrary File Download vulnerability<= 1.55.0.208/07/2026
- Cross Site Scripting (XSS) vulnerability<= 1.53.124/06/2026
- Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export vulnerability<= 1.53.007/05/2026
- Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure vulnerability<= 1.51.106/05/2026
- Unauthenticated Arbitrary File Read vulnerability<= 1.52.105/05/2026
- Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass vulnerability<= 1.52.004/05/2026
- Broken Access Control vulnerability<= 1.50.222/02/2026
- WordPress Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability<= 1.50.216/02/2026
- Missing Authorization to Authenticated (Forminator User+) CSV Export vulnerability<= 1.49.108/01/2026
- Authenticated (Administrator+) SQL Injection via `order_by` Parameter vulnerability<= 1.45.018/07/2025
- Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion vulnerability<= 1.44.201/07/2025
- Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion vulnerability<= 1.44.201/07/2025
- Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters vulnerability<= 1.44.105/06/2025
- Order Replay vulnerability<= 1.42.017/04/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' vulnerability<= 1.42.017/04/2025
- Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability1.39.226/02/2025
- Admin+ Stored XSS vulnerability< 1.38.314/02/2025
- Reflected Cross-Site Scripting via Title Parameter vulnerability<= 1.38.230/01/2025
- Insecure Direct Object Reference to Submission Manipulation vulnerability<= 1.36.031/10/2024
- Missing Authorization to Authenticated Form Update and Creation vulnerability<= 1.35.128/10/2024
- Cross-Site Request Forgery to Draft Custom Form Creation vulnerability<= 1.35.116/10/2024
- Cross-Site Request Forgery to Draft Quiz Creation vulnerability<= 1.35.116/10/2024
- HubSpot Developer API Key Sensitive Information Exposure vulnerability<= 1.29.102/08/2024
- Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode vulnerability<= 1.29.209/04/2024
- Unauthenticated Stored Cross-Site Scripting via File Upload vulnerability<= 1.29.001/04/2024
- Reflected Cross Site Scripting (XSS) vulnerability<= 1.29.025/03/2024
- Authenticated (Administrator+) Arbitrary File Upload vulnerability<= 1.27.015/11/2023
- Unauthenticated Arbitrary File Upload vulnerability<= 1.24.629/08/2023
- Unauth. Race Condition vulnerability< 1.24.104/07/2023
- Multiple Missing Authorization vulnerability<= 1.22.113/04/2023
- Stored Cross-Site Scripting (XSS) vulnerability<= 1.15.220/10/2021
- Stored Cross-Site Scripting (XSS) vulnerability<= 1.14.1114/07/2021
- Cross-Site Request Forgery (CSRF) vulnerability<= 1.14.801/03/2021
- Cross-Site Request Forgery (CSRF) vulnerability<= 1.13.416/09/2020
- Unauthenticated Persistent Cross-Site Scripting (XSS) vulnerability<= 1.5.406/02/2019
- Authenticated Blind SQL Injection (SQLi) vulnerability<= 1.5.406/02/2019