Forminator Forms – Contact Form, Payment Form & Custom Form Builder Security & Risk Analysis

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion

Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters

Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'

Forminator <= 1.42.0 - Order Replay Vulnerability

Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.38.2 - Authenticated (Admin+) Stored Cross-Site Scripting

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.34.0 - Reflected Cross-Site Scripting

Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

Forminator <= 1.29.2 - Authenticated (Admin+) SQL Injection

Forminator <= 1.15.2 - Reflected Cross-Site Scripting

Forminator <= 1.28.1 - Unauthenticated Arbitrary File Upload

Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode

Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload

Forminator <= 1.29.0 - Reflected Cross-Site Scripting

Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload

Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.27.0 - Authenticated (Admin+) Stored Cross-Site Scripting

Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

Forminator <= 1.24.1 - Reflected Cross-Site Scripting

Forminator <= 1.23.3 - Race Condition to Multiple Poll Voting

Forminator <= 1.22.1 - Missing Authorization on 'load_hcaptcha_preview' AJAX function

Forminator <= 1.22.1 - Missing Authorization on 'load_recaptcha_preview' AJAX function

Forminator <= 1.22.1 - Missing Authorization on 'hubspot_support_request' AJAX function

Forminator <= 1.15.2 - Admin+ Stored Cross-Site Scripting

Forminator <= 1.14.11 - Unauthenticated Stored Cross-Site Scripting

Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass

Forminator Plugin <= 1.5.4 - Cross-Site Scripting

Forminator Plugin <= 1.5.3.1 - SQL Injection