wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder.

Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Broken access control

Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadata

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Path traversal

Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Code injection

Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Code injection

Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site scripting (XSS)

Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site scripting (XSS)

Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Code injection

Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site scripting (XSS)

Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site scripting (XSS)

Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site scripting (XSS)

Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Unrestricted file upload

Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Broken access control

Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site scripting (XSS)

Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Broken access control

Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Broken access control

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Path traversal

Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Broken access control

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site scripting (XSS)

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Broken access control

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• SQL injection

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Insecure deserialization

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Path traversal

Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site scripting (XSS)

Forminator <= 1.42.0 - Order Replay Vulnerability

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• CWE-354

Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site scripting (XSS)

Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site scripting (XSS)

Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site scripting (XSS)

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Broken access control

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Broken access control

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site request forgery (CSRF)

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site request forgery (CSRF)

Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Hard-coded credentials

Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site scripting (XSS)

Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site scripting (XSS)

Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Unrestricted file upload

Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Unrestricted file upload

Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass

• wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
• Cross-site request forgery (CSRF)