Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Forminator Forms – Contact Form, Payment Form & Custom Form Builder — Vulnerabilities & Security Advisories 33

All 33 CVE vulnerabilities found in Forminator Forms – Contact Form, Payment Form & Custom Form Builder, with AI-generated Chinese analysis, references, and POCs.

This page aggregates vulnerability data for the WordPress plugin Forminator Forms, developed by the vendor WPForms, focusing on specific weakness types and security tags. It collects a historical record of reported security flaws, covering the full timeline of advisories issued for this contact form and payment form builder. Readers can use this hub to track the vendor’s security advisories, analyze patterns within a particular weakness class, and review the complete vulnerability history associated with the product.

Vendor: wpmudev

CVE ID Title CVSS Severity Published
CVE-2026-92144 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter CWE-79 7.2 High 2026-10-01
CVE-2026-85235 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field CWE-79 7.2 High 2026-10-01
CVE-2026-92229 Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter CWE-94 9.1 Critical 2026-09-19
CVE-2026-18324 Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field CWE-79 7.2 High 2026-08-28
CVE-2026-18328 Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter CWE-79 7.2 High 2026-08-25
CVE-2026-18323 Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) CWE-79 7.2 High 2026-08-25
CVE-2026-15748 Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration CWE-434 9.8 Critical 2026-08-18
CVE-2026-12998 Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter CWE-639 5.3 Medium 2026-08-16
CVE-2026-18325 Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field CWE-79 7.2 High 2026-08-06
CVE-2026-6214 Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook CWE-862 6.5 Medium 2026-05-07
CVE-2026-6222 Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter CWE-862 5.3 Medium 2026-05-07
CVE-2026-5192 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' CWE-22 7.5 High 2026-05-05
CVE-2026-2729 Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter CWE-639 5.3 Medium 2026-05-05
CVE-2026-2002 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CWE-79 4.4 Medium 2026-02-17
CVE-2025-14782 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export CWE-862 5.3 Medium 2026-01-09
CVE-2025-7638 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter CWE-89 4.9 Medium 2025-07-18
CVE-2025-6464 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion CWE-502 7.5 High 2025-07-02
CVE-2025-6463 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion CWE-73 8.8 High 2025-07-02
CVE-2025-5341 Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters CWE-79 6.4 Medium 2025-06-05
CVE-2025-3487 Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' CWE-79 6.4 Medium 2025-04-17
CVE-2025-3479 Forminator <= 1.42.0 - Order Replay Vulnerability CWE-354 5.3 Medium 2025-04-17
CVE-2025-0469 Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting CWE-79 6.4 Medium 2025-02-27
CVE-2025-0470 Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter CWE-79 6.1 Medium 2025-01-31
CVE-2024-9700 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation CWE-639 5.3 Medium 2024-10-31
CVE-2024-10402 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation CWE-862 7.5 High 2024-10-26
CVE-2024-9351 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation CWE-352 4.3 Medium 2024-10-17
CVE-2024-9352 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation CWE-352 4.3 Medium 2024-10-17
CVE-2024-7389 Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure CWE-522 7.5 High 2024-08-02
CVE-2024-1794 Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload CWE-79 7.2 High 2024-04-09
CVE-2024-3053 Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode CWE-79 6.4 Medium 2024-04-09

All 33 known CVE vulnerabilities affecting Forminator Forms – Contact Form, Payment Form & Custom Form Builder with full Chinese analysis, references, and POCs where available.