Product by WPMU DEV

    Forminator Forms

    20 known vulnerabilities in Forminator Forms (WPMU DEV), 0 of them actively exploited (CISA KEV).

    Key figures

    20

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Forminator Forms (WPMU DEV)
    HighCVE-2025-6463

    Incsub Forminator: External Control of File Name or Path

    also in 1 other product

    		8.8
    CriticalCVE-2023-4596

    Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

    also in 1 other product

    		9.8
    HighCVE-2024-31077

    WPMU DEV Forminator: SQL Injection

    also in 1 other product

    		7.2
    MediumCVE-2023-3134

    Forminator < 1.24.4 - Reflected XSS

    		6.1
    MediumCVE-2019-9568

    Incsub Forminator: SQL Injection

    		6.5
    MediumCVE-2019-9567

    Incsub Forminator: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2025-6464

    Incsub Forminator: Deserialization of Untrusted Data

    also in 1 other product

    		7.5
    HighCVE-2024-7389

    Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

    also in 1 other product

    		7.5
    MediumCVE-2023-6133

    Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload

    also in 1 other product

    		6.6
    HighCVE-2024-1794

    Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload

    also in 1 other product

    		7.2
    MediumCVE-2024-28890

    WPMU DEV Forminator: Information Disclosure

    also in 1 other product

    		5.3
    MediumCVE-2024-31857

    WPMU DEV Forminator: Cross-Site Scripting (XSS)

    also in 1 other product

    		5.4
    HighCVE-2024-29777

    WordPress Forminator plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability

    also in 1 other product

    		7.1
    MediumCVE-2024-45625

    WPMU DEV Forminator: Cross-Site Scripting (XSS)

    also in 1 other product

    		6.1
    HighCVE-2021-36821

    WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability

    also in 1 other product

    		7.1
    MediumCVE-2024-3053

    Incsub Forminator: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2021-24700

    Forminator < 1.15.4 - Admin+ Stored Cross-Site Scripting

    		4.8
    MediumCVE-2021-4417

    Incsub Forminator: Cross-Site Request Forgery (CSRF)

    also in 1 other product

    		5.4
    MediumCVE-2023-5119

    Forminator and Forminator Pro < 1.27.0 - Admin+ Stored Cross-Site Scripting

    		4.8
    LowCVE-2023-2010

    Forminator < 1.24.1 - Unauthenticated Race Condition on poll vote

    		3.1

    All products by WPMU DEV