Product by WPMU DEV

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder

    36 known vulnerabilities in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (WPMU DEV), 0 of them actively exploited (CISA KEV).

    Key figures

    36

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (WPMU DEV)
    CriticalCVE-2026-15748

    Unrestricted Upload of File with Dangerous Type (CVE-2026-15748)

    		9.8
    HighCVE-2025-6463

    Incsub Forminator: External Control of File Name or Path

    also in 1 other product

    		8.8
    CriticalCVE-2023-4596

    Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

    also in 1 other product

    		9.8
    CriticalCVE-2026-92229

    Code Injection (CVE-2026-92229)

    		9.1
    HighCVE-2026-5192

    Path Traversal (CVE-2026-5192)

    		7.5
    HighCVE-2026-18323

    Cross-site Scripting (CVE-2026-18323)

    		7.2
    HighCVE-2026-18324

    Cross-site Scripting (CVE-2026-18324)

    		7.2
    HighCVE-2026-92144

    Cross-site Scripting (CVE-2026-92144)

    		7.2
    HighCVE-2026-18325

    Cross-site Scripting (CVE-2026-18325)

    		7.2
    HighCVE-2026-18328

    Cross-site Scripting (CVE-2026-18328)

    		7.2
    HighCVE-2026-85235

    Cross-site Scripting (CVE-2026-85235)

    		7.2
    MediumCVE-2026-101335

    Code Injection (CVE-2026-101335)

    		6.5
    MediumCVE-2026-103911

    Code Injection (CVE-2026-103911)

    		6.5
    MediumCVE-2026-12998

    Authorization Bypass Through User-Controlled Key (CVE-2026-12998)

    		5.3
    HighCVE-2025-6464

    Incsub Forminator: Deserialization of Untrusted Data

    also in 1 other product

    		7.5
    HighCVE-2024-7389

    Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

    also in 1 other product

    		7.5
    MediumCVE-2023-6133

    Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload

    also in 1 other product

    		6.6
    MediumCVE-2026-5461

    Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata

    		6.5
    MediumCVE-2026-6214

    Missing Authorization (CVE-2026-6214)

    		6.5
    HighCVE-2024-10402

    WPMU DEV Forminator Forms: Missing Authorization

    also in 1 other product

    		7.5
    HighCVE-2024-1794

    Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload

    also in 1 other product

    		7.2
    MediumCVE-2026-6222

    Missing Authorization (CVE-2026-6222)

    		5.3
    MediumCVE-2026-2729

    Authorization Bypass Through User-Controlled Key (CVE-2026-2729)

    		5.3
    MediumCVE-2025-5341

    WPMU DEV Forminator Forms: Cross-site Scripting

    also in 1 other product

    		6.4
    MediumCVE-2025-3487

    Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'

    also in 1 other product

    		6.4

    All vulnerabilities in search

    News

    All products by WPMU DEV