Forminator Forms – Contact Form, Payment Form & Custom Form Builder

Güvenlik açıkları

• CVE-2026-66583kimlik doğrulamasız≤ 1.57.0

  WordPress Forminator plugin <= 1.57.0 - PHP Object Injection vulnerability

  Kritik 9.8

• CVE-2026-15748kimlik doğrulamasız≤ 1.56.1

  Forminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration

  Kritik 9.8

• CVE-2023-4596kimlik doğrulamasız≤ 1.24.6

  Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

  Kritik 9.8

• CVE-2026-92229kimlik doğrulamasız≤ 1.57.2

  Forminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter

  Kritik 9.1

• CVE-2025-6464kimlik doğrulamasız · tıklama gerekir≤ 1.44.2

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Sub

  Yüksek 8.8

• CVE-2025-6463kimlik doğrulamasız · tıklama gerekir≤ 1.44.2

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submiss

  Yüksek 8.8

• CVE-2026-28111katılımcı+≤ 1.56.0

  WordPress Forminator plugin <= 1.56.0 - Privilege Escalation vulnerability

  Yüksek 8.8

• CVE-2026-57815kimlik doğrulamasız≤ 1.55.0.2

  WordPress Forminator plugin <= 1.55.0.2 - Arbitrary File Download vulnerability

  Yüksek 7.5

• CVE-2026-5192kimlik doğrulamasız≤ 1.52.1

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'

  Yüksek 7.5

• CVE-2024-7389kimlik doğrulamasız≤ 1.29.1

  Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

  Yüksek 7.5

• CVE-2026-92144kimlik doğrulamasız≤ 1.57.2

  Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter

  Yüksek 7.2

• CVE-2026-85235kimlik doğrulamasız≤ 1.57.2

  Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

  Yüksek 7.2

• CVE-2026-18324kimlik doğrulamasız≤ 1.57.0.1

  Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

  Yüksek 7.2

• CVE-2026-18328kimlik doğrulamasız≤ 1.57.0

  Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter

  Yüksek 7.2

• CVE-2026-18323kimlik doğrulamasız≤ 1.57.0.2

  Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)

  Yüksek 7.2

• CVE-2026-18325kimlik doğrulamasız≤ 1.56.1

  Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field

  Yüksek 7.2

• CVE-2024-31077yüksek yetki

  Forminator prior to 1.29.3 contains a SQL injection vulnerability.

  Yüksek 7.2

• CVE-2026-28143kimlik doğrulamasız · tıklama gerekir≤ 1.56.0

  WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability

  Yüksek 7.1

• CVE-2026-57814kimlik doğrulamasız · tıklama gerekir≤ 1.55.0.1

  WordPress Forminator plugin <= 1.55.0.1 - Cross Site Scripting (XSS) vulnerability

  Yüksek 7.1

• CVE-2026-56071kimlik doğrulamasız · tıklama gerekir≤ 1.53.1

  WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability

  Yüksek 7.1

• CVE-2026-6214abone+≤ 1.53.0

  Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_lo

  Orta 6.5

• CVE-2019-9568giriş gerekir

  The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=formina

  Orta 6.5

• CVE-2025-5341katılımcı+≤ 1.44.1

  Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters

  Orta 6.4

• CVE-2025-0470kimlik doğrulamasız · tıklama gerekir≤ 1.38.2

  Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title Parameter

  Orta 6.1

• CVE-2024-45625kimlik doğrulamasız · tıklama gerekir

  Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1.

  Orta 6.1

• CVE-2024-1794kimlik doğrulamasız≤ 1.29.0

  Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload

  Orta 6.1

• CVE-2024-29777kimlik doğrulamasız · tıklama gerekir≤ 1.29.0

  WordPress Forminator plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability

  Orta 6.1

• CVE-2021-36821kimlik doğrulamasız · tıklama gerekir≤ 1.14.11

  WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability

  Orta 6.1

• CVE-2019-9567kimlik doğrulamasız · tıklama gerekir

  The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.

  Orta 6.1

• CVE-2024-31857kimlik doğrulamasız · tıklama gerekir

  Forminator prior to 1.15.4 contains a cross-site scripting vulnerability.

  Orta 5.4

• CVE-2025-3487katılımcı+≤ 1.42.0

  Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'

  Orta 5.4

• CVE-2025-0469katılımcı+

  Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

  Orta 5.4

• CVE-2024-3053katılımcı+≤ 1.29.2

  Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode

  Orta 5.4

• CVE-2026-82220kimlik doğrulamasız≤ 1.57.1

  WordPress Forminator plugin <= 1.57.1 - Other vulnerability Type vulnerability

  Orta 5.3

• CVE-2026-12998kimlik doğrulamasız≤ 1.55.0.2

  Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter

  Orta 5.3

• CVE-2026-2729kimlik doğrulamasız≤ 1.52.0

  Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Byp

  Orta 5.3

• CVE-2026-32409kimlik doğrulamasız≤ 1.50.2

  WordPress Forminator plugin <= 1.50.2 - Broken Access Control vulnerability

  Orta 5.3

• CVE-2025-3479kimlik doğrulamasız≤ 1.42.0

  Forminator <= 1.42.0 - Order Replay Vulnerability

  Orta 5.3

• CVE-2024-9700kimlik doğrulamasız≤ 1.36.0

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission Manipulation

  Orta 5.3

• CVE-2026-6222abone+≤ 1.51.1

  Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter

  Orta 5.3

• CVE-2025-14782giriş gerekir≤ 1.49.1

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export

  Orta 5.3

• CVE-2024-28890giriş gerekir

  Forminator prior to 1.29.0 contains an unrestricted upload of file with dangerous type vulnerability.

  Orta 5.3

• CVE-2025-7638yönetici≤ 1.45.0

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter

  Orta 4.9

• CVE-2023-6133yönetici≤ 1.27.0

  Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload

  Orta 4.9

• CVE-2026-2002yönetici≤ 1.50.2

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

  Orta 4.4

• CVE-2024-9352kimlik doğrulamasız · tıklama gerekir≤ 1.35.1

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form Creation

  Orta 4.3

• CVE-2024-9351kimlik doğrulamasız · tıklama gerekir≤ 1.35.1

  Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz Creation

  Orta 4.3

• CVE-2021-4417kimlik doğrulamasız · tıklama gerekir→ 1.13.5

  Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery Bypass

  Orta 4.3