Now officially on WordPress.org

CVE Database / CVE-2019-9567

CVE · Medium

CVE-2019-9567 — Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.6

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2019-9567, CVE-2019-9568 Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.6 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Medium 6.1 < 1.6 1.6 2019-02-06 —

CVE-2019-9567, CVE-2019-9568

The Forminator plugin versions prior to 1.6 contain a cross-site scripting vulnerability in its poll functionality, specifically through custom input fields. An attacker can inject malicious scripts via these fields, which are then executed in the browsers of users viewing the poll. This flaw affects the plugin's contact form, poll, and quiz builder features up until the 1.6 release.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings