WordPress forminator has 23 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2025-6463 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to | high | 8.8 | <1.44.3 | 1.44.3 |
| CVE-2023-4596 | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uplo | critical | 9.8 | <=1.24.6 | – |
| CVE-2023-3134 | The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-popul | medium | 6.1 | <1.24.4 | 1.24.4 |
| CVE-2019-9568 | The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=formina | medium | 6.5 | <1.6 | 1.6 |
| CVE-2019-9567 | The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll. | medium | 6.1 | <1.6 | 1.6 |
| CVE-2023-6133 | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime | medium | 6.6 | <=1.27.0 | – |
| CVE-2024-7389 | The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-f | high | 7.5 | <1.29.2 | 1.29.2 |
| CVE-2021-24700 | The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to | medium | 4.8 | <1.15.4 | 1.15.4 |
| CVE-2025-6464 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all ve | high | 7.5 | <1.44.3 | 1.44.3 |
| CVE-2024-1794 | The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to | high | 7.2 | <=1.29.1 | – |
| CVE-2023-5119 | The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could | medium | 4.8 | <1.27.0 | 1.27.0 |
| CVE-2024-29777 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress P | high | 7.1 | <1.29.1 | 1.29.1 |
| CVE-2021-4417 | The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versio | medium | 5.4 | <1.13.5 | 1.13.5 |
| CVE-2024-9700 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Referen | medium | 5.3 | <1.36.1 | 1.36.1 |
| CVE-2023-2010 | The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update th | low | 3.1 | <1.24.1 | 1.24.1 |
| CVE-2024-3053 | The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | medium | 6.4 | <1.29.3 | 1.29.3 |
| CVE-2025-0470 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting | medium | 6.1 | <1.38.3 | 1.38.3 |
| CVE-2025-3487 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi | medium | 6.4 | <1.42.1 | 1.42.1 |
| CVE-2025-5341 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi | medium | 6.4 | <1.44.2 | 1.44.2 |
| CVE-2025-0469 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi | medium | 6.4 | <1.39.3 | 1.39.3 |
| CVE-2024-9351 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 4.3 | <1.36.0 | 1.36.0 |
| CVE-2024-9352 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in | medium | 4.3 | <1.36.0 | 1.36.0 |
| CVE-2025-3479 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions u | medium | 5.3 | <1.42.1 | 1.42.1 |
Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden wordpress /var/www/html
Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.
Install docs How findings are ranked