PLUGIN SECURITY
Is Forminator safe?
Best WordPress form builder plugin. Create contact forms, payment forms & order forms with 1000+ integrations.
What this plugin does
- Slug:
forminator - Author: WPMU DEV - Your All-in-One WordPress Platform
- 600000+ active installs
- 96/100 rating (2139 reviews on wordpress.org)
- 21577806 all-time downloads
- On WordPress.org since 2018-09-04
contact formcustom formformspayment formWordPress form plugin
Maintenance status
- Latest known version: 1.56.2
- Last updated: 2026-10-14 9:42am GMT
- Tested up to WordPress: 7.1.3
- Requires PHP: 7.4+
Known vulnerabilities
81 known CVEs on file for Forminator.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-101335 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.58.2 | Improper Control of Generation of Code ('Code Injection') | Medium 6.5 | < 1.58.2 | 1.58.2 | 2026-10-15 | ⚠ update needed |
| CVE-2026-103911 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.58.2 | Improper Control of Generation of Code ('Code Injection') | Medium 6.5 | < 1.58.2 | 1.58.2 | 2026-10-15 | ⚠ update needed |
| CVE-2026-102388 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.58.0 | — | High 7.1 | < 1.58.0 | 1.58.0 | 2026-10-10 | ⚠ update needed |
| CVE-2026-96341 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.58.0 | — | High 8.2 | < 1.58.0 | 1.58.0 | 2026-10-10 | ⚠ update needed |
| CVE-2026-65459 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.58.0 | Missing Authorization | High 7.5 | < 1.58.0 | 1.58.0 | 2026-10-10 | ⚠ update needed |
| CVE-2026-96336 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.2.1 | — | High 7.5 | < 1.57.2.1 | 1.57.2.1 | 2026-10-09 | ⚠ update needed |
| CVE-2026-108486 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.58.1 | — | Medium 5.3 | < 1.58.1 | 1.58.1 | 2026-10-08 | ⚠ update needed |
| CVE-2026-96335 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.3 | Missing Authorization | High 7.5 | < 1.57.3 | 1.57.3 | 2026-10-07 | ⚠ update needed |
+ 87 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-106611 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.58.0 | — | High 7.1 | < 1.58.0 | 1.58.0 | 2026-10-02 | ⚠ update needed |
| CVE-2026-85235 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.2.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 1.57.2.1 | 1.57.2.1 | 2026-09-30 | ⚠ update needed |
| CVE-2026-92144 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.2.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 1.57.2.1 | 1.57.2.1 | 2026-09-30 | ⚠ update needed |
| CVE-2026-87070 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.2.1 | Use of Less Trusted Source | Medium 5.3 | < 1.57.2.1 | 1.57.2.1 | 2026-09-21 | ⚠ update needed |
| CVE-2026-87069 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.2.1 | Missing Authorization | Unknown | < 1.57.2.1 | 1.57.2.1 | 2026-09-21 | ⚠ update needed |
| CVE-2026-87074 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.2.1 | Missing Authorization | Unknown | < 1.57.2.1 | 1.57.2.1 | 2026-09-21 | ⚠ update needed |
| CVE-2026-87071 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.2.1 | Improper Input Validation | Medium 5.3 | < 1.57.2.1 | 1.57.2.1 | 2026-09-21 | ⚠ update needed |
| CVE-2026-87067 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.2.1 | Improper Control of Generation of Code ('Code Injection') | High 8.5 | < 1.57.2.1 | 1.57.2.1 | 2026-09-18 | ⚠ update needed |
| CVE-2026-87068 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.2.1 | Improper Privilege Management | Medium 6.6 | < 1.57.2.1 | 1.57.2.1 | 2026-09-18 | ⚠ update needed |
| CVE-2026-82220 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.2 | Authentication Bypass by Capture-replay | Medium 5.3 | < 1.57.2 | 1.57.2 | 2026-08-28 | ⚠ update needed |
| CVE-2026-92229 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.3 | Improper Control of Generation of Code ('Code Injection') | Critical 9.1 | < 1.57.3 | 1.57.3 | 2026-08-28 | ⚠ update needed |
| CVE-2026-19220 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.1 | Improper Privilege Management | Unknown | < 1.57.1 | 1.57.1 | 2026-08-26 | ⚠ update needed |
| CVE-2026-18323 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.0.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 1.57.0.3 | 1.57.0.3 | 2026-08-24 | ⚠ update needed |
| CVE-2026-18328 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.0.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 1.57.0.1 | 1.57.0.1 | 2026-08-24 | ⚠ update needed |
| CVE-2026-18324 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.0.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 1.57.0.2 | 1.57.0.2 | 2026-08-24 | ⚠ update needed |
| CVE-2026-19222 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.0.7 | Improper Privilege Management | Medium 6.6 | < 1.57.0.7 | 1.57.0.7 | 2026-08-22 | ⚠ update needed |
| CVE-2026-19221 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.0.5 | Improper Control of Generation of Code ('Code Injection') | High 7.2 | < 1.57.0.5 | 1.57.0.5 | 2026-08-22 | ⚠ update needed |
| CVE-2026-66583 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.57.1 | Deserialization of Untrusted Data | Critical 9.8 | < 1.57.1 | 1.57.1 | 2026-08-20 | ⚠ update needed |
| CVE-2026-15748 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.56.2 | Unrestricted Upload of File with Dangerous Type | Critical 9.8 | < 1.56.2 | 1.56.2 | 2026-08-18 | ✓ fixed in latest |
| CVE-2026-12998 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.55.1 | Authorization Bypass Through User-Controlled Key | Medium 5.3 | < 1.55.1 | 1.55.1 | 2026-08-15 | ✓ fixed in latest |
| CVE-2026-18325 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.56.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 1.56.2 | 1.56.2 | 2026-08-05 | ✓ fixed in latest |
| CVE-2026-28143 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.56.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 1.56.1 | 1.56.1 | 2026-08-03 | ✓ fixed in latest |
| CVE-2026-28111 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.56.0.1 | Incorrect Privilege Assignment | High 8.8 | < 1.56.0.1 | 1.56.0.1 | 2026-08-03 | ✓ fixed in latest |
| CVE-2026-57815 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.55.1 | — | High 7.5 | < 1.55.1 | 1.55.1 | 2026-07-08 | ✓ fixed in latest |
| CVE-2026-57814 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.55.0.2 | — | High 7.1 | < 1.55.0.2 | 1.55.0.2 | 2026-07-08 | ✓ fixed in latest |
| CVE-2026-56071 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.53.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 1.53.2 | 1.53.2 | 2026-06-24 | ✓ fixed in latest |
| CVE-2026-6214 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.53.0.1 | Missing Authorization | Medium 6.5 | < 1.53.0.1 | 1.53.0.1 | 2026-05-06 | ✓ fixed in latest |
| CVE-2026-6222 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.52 | Missing Authorization | Medium 5.3 | < 1.52 | 1.52 | 2026-05-06 | ✓ fixed in latest |
| CVE-2026-5192 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.52.2 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | High 7.5 | < 1.52.2 | 1.52.2 | 2026-05-04 | ✓ fixed in latest |
| CVE-2026-2729 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.52.1 | Authorization Bypass Through User-Controlled Key | Medium 5.3 | < 1.52.1 | 1.52.1 | 2026-05-04 | ✓ fixed in latest |
| CVE-2026-32409 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.50.3 | Missing Authorization | Medium 5.3 | < 1.50.3 | 1.50.3 | 2026-02-22 | ✓ fixed in latest |
| CVE-2025-14782 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.49.2 | Missing Authorization | Medium 5.3 | < 1.49.2 | 1.49.2 | 2026-01-08 | ✓ fixed in latest |
| CVE-2024-9700 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.36.1 | Authorization Bypass Through User-Controlled Key | Medium 5.3 | < 1.36.1 | 1.36.1 | 2024-10-30 | ✓ fixed in latest |
| CVE-2024-10402 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.36.0 | Missing Authorization | High 7.5 | < 1.36.0 | 1.36.0 | 2024-10-25 | ✓ fixed in latest |
| CVE-2024-9352 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.36.0 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 1.36.0 | 1.36.0 | 2024-10-16 | ✓ fixed in latest |
| CVE-2024-9351 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.36.0 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 1.36.0 | 1.36.0 | 2024-10-16 | ✓ fixed in latest |
| CVE-2024-45625 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.34.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.34.1 | 1.34.1 | 2024-09-09 | ✓ fixed in latest |
| CVE-2024-7389 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.29.2 | Insufficiently Protected Credentials | High 7.5 | < 1.29.2 | 1.29.2 | 2024-08-01 | ✓ fixed in latest |
| CVE-2024-31857 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.15.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.15.4 | 1.15.4 | 2024-04-23 | ✓ fixed in latest |
| CVE-2024-31077 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.29.3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.2 | < 1.29.3 | 1.29.3 | 2024-04-23 | ✓ fixed in latest |
| CVE-2024-28890 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.29.0 | Unrestricted Upload of File with Dangerous Type | Medium 5.3 | < 1.29.0 | 1.29.0 | 2024-04-18 | ✓ fixed in latest |
| CVE-2024-3053 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.29.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.29.3 | 1.29.3 | 2024-04-08 | ✓ fixed in latest |
| CVE-2024-1794 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.29.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.29.1 | 1.29.1 | 2024-03-29 | ✓ fixed in latest |
| CVE-2024-29777 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.29.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 1.29.1 | 1.29.1 | 2024-03-25 | ✓ fixed in latest |
| CVE-2023-6133 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.28.0 | Unrestricted Upload of File with Dangerous Type | Medium 4.9 | < 1.28.0 | 1.28.0 | 2023-11-14 | ✓ fixed in latest |
| CVE-2023-5119 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.27.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 1.27.0 | 1.27.0 | 2023-10-27 | ✓ fixed in latest |
| CVE-2023-4596 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.25.0 | Unrestricted Upload of File with Dangerous Type | Critical 9.8 | < 1.25.0 | 1.25.0 | 2023-08-29 | ✓ fixed in latest |
| CVE-2023-3134 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.24.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.24.4 | 1.24.4 | 2023-07-10 | ✓ fixed in latest |
| CVE-2023-2010 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.24.1 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | Low 3.1 | < 1.24.1 | 1.24.1 | 2023-06-12 | ✓ fixed in latest |
| CVE-2021-4342 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.14.8.1 | — | Unknown | < 1.14.8.1 | 1.14.8.1 | 2023-06-07 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.23.3 | — | Unknown | < 1.23.3 | 1.23.3 | 2023-04-13 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.23.3 | — | Unknown | < 1.23.3 | 1.23.3 | 2023-04-12 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.23.3 | — | Unknown | < 1.23.3 | 1.23.3 | 2023-04-12 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.23.3 | — | Unknown | < 1.23.3 | 1.23.3 | 2023-04-12 | ✓ fixed in latest |
| CVE-2021-24700 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.15.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 1.15.4 | 1.15.4 | 2021-10-20 | ✓ fixed in latest |
| CVE-2021-36821 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.14.12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.14.12 | 1.14.12 | 2021-07-14 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.14.8.1 | — | Unknown | < 1.14.8.1 | 1.14.8.1 | 2021-03-01 | ✓ fixed in latest |
| CVE-2021-4417 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.13.5 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 1.13.5 | 1.13.5 | 2021-03-01 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.13.5 | — | Unknown | < 1.13.5 | 1.13.5 | 2020-09-16 | ✓ fixed in latest |
| CVE-2019-9567, CVE-2019-9568 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.6 | 1.6 | 2019-02-06 | ✓ fixed in latest |
| CVE-2019-9568 | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.6 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 1.6 | 1.6 | 2019-02-06 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.6 | — | Unknown | < 1.6 | 1.6 | 2019-02-06 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.6 | — | Unknown | < 1.6 | 1.6 | 2019-02-06 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.38.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 1.38.3 | 1.38.3 | 0000-00-00 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.39.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.39.3 | 1.39.3 | 0000-00-00 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.42.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 1.42.1 | 1.42.1 | 0000-00-00 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.42.1 | Improper Validation of Integrity Check Value | Medium 5.3 | < 1.42.1 | 1.42.1 | 0000-00-00 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.38.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 1.38.3 | 1.38.3 | 0000-00-00 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.44.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 1.44.2 | 1.44.2 | 0000-00-00 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.44.3 | External Control of File Name or Path | High 8.8 | < 1.44.3 | 1.44.3 | 0000-00-00 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.44.3 | Deserialization of Untrusted Data | High 8.8 | < 1.44.3 | 1.44.3 | 0000-00-00 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.45.1 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 4.9 | < 1.45.1 | 1.45.1 | 0000-00-00 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.50.3 | — | Unknown | < 1.50.3 | 1.50.3 | 0000-00-00 | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.14.8.1 | — | Unknown | < 1.14.8.1 | 1.14.8.1 | — | ✓ fixed in latest |
| — | Forminator Forms – Contact Form, Payment Form & Custom Form Builder [forminator] < 1.14.8.1 | — | Unknown | < 1.14.8.1 | 1.14.8.1 | — | ✓ fixed in latest |
| CVE-2020-36707, CVE-2021-4417, CVE-2020-36752, CVE-2020-36757, CVE-2020-36756, CVE-2020-36761, CVE-2020-36760, CVE-2020-36760 | Multiple Plugins/Themes - Cross-Site Request Forgery (CSRF) | — | Unknown | < 1.13.5 | 1.13.5 | — | ✓ fixed in latest |
| CVE-2021-4414, CVE-2021-4425 | Multiple Plugins - CSRF Nonce Bypasses | — | Unknown | < 1.14.8.1 | 1.14.8.1 | — | ✓ fixed in latest |
| CVE-2024-7052 | Forminator < 1.38.3 - Admin+ Stored XSS | — | Unknown | < 1.38.3 | 1.38.3 | — | ✓ fixed in latest |
| CVE-2025-0470 | Forminator < 1.38.3 - Reflected XSS via Title Parameter | — | Unknown | < 1.38.3 | 1.38.3 | — | ✓ fixed in latest |
| CVE-2025-0469 | Forminator < 1.39.3 - Contributor+ Stored Cross-Site Scripting | — | Unknown | < 1.39.3 | 1.39.3 | — | ✓ fixed in latest |
| CVE-2025-3487 | Forminator < 1.42.1 - Contributor+ Stored XSS via 'limit' | — | Unknown | < 1.42.1 | 1.42.1 | — | ✓ fixed in latest |
| CVE-2025-3479 | Forminator < 1.42.1 - Order Replay Vulnerability | — | Unknown | < 1.42.1 | 1.42.1 | — | ✓ fixed in latest |
| CVE-2025-5341 | Forminator < 1.44.2 - Contributor+ Stored DOM-Based XSS via id and data-size Parameters | — | Unknown | < 1.44.2 | 1.44.2 | — | ✓ fixed in latest |
| CVE-2025-6463 | Forminator Forms < 1.44.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion | — | Unknown | < 1.44.3 | 1.44.3 | — | ✓ fixed in latest |
| CVE-2025-6464 | Forminator Forms < 1.44.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion | — | Unknown | < 1.44.3 | 1.44.3 | — | ✓ fixed in latest |
| CVE-2025-7638 | Forminator Forms < 1.45.1 - Admin+ SQLi | — | Unknown | < 1.45.1 | 1.45.1 | — | ✓ fixed in latest |
| CVE-2026-2002 | Forminator Forms < 1.50.3 - Admin+ Stored XSS | — | Unknown | < 1.50.3 | 1.50.3 | — | ✓ fixed in latest |
How to fix it
Keep Forminator updated — 1.56.2 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Contact Form 7 — 10000000+ active installs — 80/100 (2183) — max PHP 8.4
- Akismet Anti-spam: Spam Protection — 5000000+ active installs — 94/100 (1187) — max PHP 8.4
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — 5000000+ active installs — 96/100 (14385)
- Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — 800000+ active installs — 96/100 (806) — max PHP <8.0
- MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor — 600000+ active installs — 94/100 (509) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.