agentprime: wpmudev-forminator-forms-contact-form-payment-form-custom-form-builderEvery new CVE for wpmudev-forminator-forms-contact-form-payment-form-custom-form-builder.https://agentprime.io/CVE-2026-97638: Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameterhttps://agentprime.io/advisories/CVE-2026-97638/https://agentprime.io/advisories/CVE-2026-97638/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 17:15:27 GMTCVECVE-2026-5461: Forminator Forms <= 1.55.0.2 - Unauthenticated Limited File Deletion via Draft Upload Metadatahttps://agentprime.io/advisories/CVE-2026-5461/https://agentprime.io/advisories/CVE-2026-5461/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 04:32:43 GMTCVECVE-2026-103911: Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_blockhttps://agentprime.io/advisories/CVE-2026-103911/https://agentprime.io/advisories/CVE-2026-103911/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 04:27:02 GMTCVECVE-2026-101335: Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tagshttps://agentprime.io/advisories/CVE-2026-101335/https://agentprime.io/advisories/CVE-2026-101335/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 16 Oct 2026 04:26:58 GMTCVECVE-2026-92144: Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameterhttps://agentprime.io/advisories/CVE-2026-92144/https://agentprime.io/advisories/CVE-2026-92144/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 09:26:58 GMTCVECVE-2026-85235: Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Fieldhttps://agentprime.io/advisories/CVE-2026-85235/https://agentprime.io/advisories/CVE-2026-85235/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 08:28:42 GMTCVECVE-2026-92229: Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameterhttps://agentprime.io/advisories/CVE-2026-92229/https://agentprime.io/advisories/CVE-2026-92229/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 19 Sep 2026 02:27:10 GMTCVEcriticalCVE-2026-18324: Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Fieldhttps://agentprime.io/advisories/CVE-2026-18324/https://agentprime.io/advisories/CVE-2026-18324/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 28 Aug 2026 03:39:34 GMTCVECVE-2026-18328: Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameterhttps://agentprime.io/advisories/CVE-2026-18328/https://agentprime.io/advisories/CVE-2026-18328/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 07:39:50 GMTCVECVE-2026-18323: Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)https://agentprime.io/advisories/CVE-2026-18323/https://agentprime.io/advisories/CVE-2026-18323/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 07:39:50 GMTCVECVE-2026-15748: Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configurationhttps://agentprime.io/advisories/CVE-2026-15748/https://agentprime.io/advisories/CVE-2026-15748/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 05:31:20 GMTCVEcriticalCVE-2026-12998: Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameterhttps://agentprime.io/advisories/CVE-2026-12998/https://agentprime.io/advisories/CVE-2026-12998/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 16 Aug 2026 06:38:07 GMTCVECVE-2026-18325: Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Fieldhttps://agentprime.io/advisories/CVE-2026-18325/https://agentprime.io/advisories/CVE-2026-18325/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 06 Aug 2026 03:26:08 GMTCVECVE-2026-6214: Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hookhttps://agentprime.io/advisories/CVE-2026-6214/https://agentprime.io/advisories/CVE-2026-6214/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 07 May 2026 03:27:06 GMTCVECVE-2026-6222: Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameterhttps://agentprime.io/advisories/CVE-2026-6222/https://agentprime.io/advisories/CVE-2026-6222/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 07 May 2026 01:25:27 GMTCVECVE-2026-5192: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'https://agentprime.io/advisories/CVE-2026-5192/https://agentprime.io/advisories/CVE-2026-5192/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 05 May 2026 06:43:30 GMTCVECVE-2026-2729: Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameterhttps://agentprime.io/advisories/CVE-2026-2729/https://agentprime.io/advisories/CVE-2026-2729/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 05 May 2026 06:43:30 GMTCVECVE-2026-2002: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scriptinghttps://agentprime.io/advisories/CVE-2026-2002/https://agentprime.io/advisories/CVE-2026-2002/CVSS 4.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 17 Feb 2026 04:35:45 GMTCVECVE-2025-14782: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Exporthttps://agentprime.io/advisories/CVE-2025-14782/https://agentprime.io/advisories/CVE-2025-14782/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Jan 2026 06:34:53 GMTCVECVE-2025-7638: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameterhttps://agentprime.io/advisories/CVE-2025-7638/https://agentprime.io/advisories/CVE-2025-7638/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 18 Jul 2025 04:23:01 GMTCVECVE-2025-6464: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletionhttps://agentprime.io/advisories/CVE-2025-6464/https://agentprime.io/advisories/CVE-2025-6464/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Jul 2025 05:29:17 GMTCVECVE-2025-6463: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletionhttps://agentprime.io/advisories/CVE-2025-6463/https://agentprime.io/advisories/CVE-2025-6463/CVSS 8.8 (High). Critical: CVSS score 8.8 (7.0 or more) and EPSS 0.15 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Wed, 02 Jul 2025 04:24:56 GMTCVEcriticalCVE-2025-5341: Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parametershttps://agentprime.io/advisories/CVE-2025-5341/https://agentprime.io/advisories/CVE-2025-5341/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Jun 2025 11:15:06 GMTCVECVE-2025-3479: Forminator <= 1.42.0 - Order Replay Vulnerabilityhttps://agentprime.io/advisories/CVE-2025-3479/https://agentprime.io/advisories/CVE-2025-3479/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Apr 2025 11:13:06 GMTCVECVE-2025-3487: Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'https://agentprime.io/advisories/CVE-2025-3487/https://agentprime.io/advisories/CVE-2025-3487/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Apr 2025 11:13:05 GMTCVECVE-2025-0469: Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scriptinghttps://agentprime.io/advisories/CVE-2025-0469/https://agentprime.io/advisories/CVE-2025-0469/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 27 Feb 2025 04:21:44 GMTCVECVE-2025-0470: Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameterhttps://agentprime.io/advisories/CVE-2025-0470/https://agentprime.io/advisories/CVE-2025-0470/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jan 2025 03:21:28 GMTCVECVE-2024-9700: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulationhttps://agentprime.io/advisories/CVE-2024-9700/https://agentprime.io/advisories/CVE-2024-9700/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 31 Oct 2024 05:31:23 GMTCVECVE-2024-10402: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creationhttps://agentprime.io/advisories/CVE-2024-10402/https://agentprime.io/advisories/CVE-2024-10402/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 26 Oct 2024 11:38:03 GMTCVECVE-2024-9351: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creationhttps://agentprime.io/advisories/CVE-2024-9351/https://agentprime.io/advisories/CVE-2024-9351/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Oct 2024 05:33:09 GMTCVECVE-2024-9352: Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creationhttps://agentprime.io/advisories/CVE-2024-9352/https://agentprime.io/advisories/CVE-2024-9352/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Oct 2024 05:33:08 GMTCVECVE-2024-7389: Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposurehttps://agentprime.io/advisories/CVE-2024-7389/https://agentprime.io/advisories/CVE-2024-7389/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 02 Aug 2024 04:29:55 GMTCVECVE-2024-1794: Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Uploadhttps://agentprime.io/advisories/CVE-2024-1794/https://agentprime.io/advisories/CVE-2024-1794/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 09 Apr 2024 18:58:38 GMTCVECVE-2024-3053: Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcodehttps://agentprime.io/advisories/CVE-2024-3053/https://agentprime.io/advisories/CVE-2024-3053/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 09 Apr 2024 18:58:34 GMTCVECVE-2023-6133: Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Uploadhttps://agentprime.io/advisories/CVE-2023-6133/https://agentprime.io/advisories/CVE-2023-6133/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Nov 2023 06:40:46 GMTCVECVE-2023-4596: Forminator <= 1.24.6 - Unauthenticated Arbitrary File Uploadhttps://agentprime.io/advisories/CVE-2023-4596/https://agentprime.io/advisories/CVE-2023-4596/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. CVSS score 9.8 (7.0 or more) and EPSS 0.14 (0.1 or more): a high score and a real chance of exploitation in the next 30 days. Published by the CVE Program. Not analysed by agentprime yet.Wed, 30 Aug 2023 01:45:37 GMTCVEcriticalCVE-2021-4417: Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypasshttps://agentprime.io/advisories/CVE-2021-4417/https://agentprime.io/advisories/CVE-2021-4417/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 12 Jul 2023 03:40:45 GMTCVE