Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload

Wordfence Intelligence   >   Vulnerability Database   >   Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload
7.2
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE CVE-2024-1794
CVSS 7.2 (High)
Publicly Published March 29, 2024
Last Updated April 9, 2024
Researcher wesley (wcraft)

Description

The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and including, 1.29.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Learn more about Cross-Site Scripting vulnerabilities and how to prevent them.

References

Share

Vulnerability Details for Forminator Forms – Contact Form, Payment Form & Custom Form Builder

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

Software Type Plugin
Software Slug forminator (view on wordpress.org)
Patched? Yes
Remediation Update to version 1.29.1, or a newer patched version
Affected Version
  • <= 1.29.0
Patched Version
  • 1.29.1

Recent vulnerabilities in Forminator Forms – Contact Form, Payment Form & Custom Form Builder

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.53.1 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-56071
Jun 24, 2026
Researcher: daroo
Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook
6.5
CVE-2026-6214
May 6, 2026
Researcher: anhcd05
Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter
5.3
CVE-2026-6222
May 6, 2026
Researcher: anhcd05
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'
7.5
CVE-2026-5192
May 4, 2026
Researcher: daroo
Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter
5.3
CVE-2026-2729
May 4, 2026
Researcher: Kittipat Jitphonchana
Forminator <= 1.50.2 - Missing Authorization
5.3
CVE-2026-32409
Feb 22, 2026
Researcher: Nguyen Tien Dung
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
4.4
CVE-2026-2002
Feb 16, 2026
Researcher: Tiến Dũng Nguyễn
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export
5.3
CVE-2025-14782
Jan 8, 2026
Researcher: type5afe
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter
4.9
CVE-2025-7638
Jul 17, 2025
Researcher: Chive
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion
7.5
CVE-2025-6464
Jul 1, 2025
Researcher: Phat RiO
# Title CVE ID CVSS Researchers Date
1 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.53.1 - Unauthenticated Stored Cross-Site Scripting CVE-2026-56071 7.2 daroo June 24, 2026
2 Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook CVE-2026-6214 6.5 anhcd05 May 6, 2026
3 Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter CVE-2026-6222 5.3 anhcd05 May 6, 2026
4 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' CVE-2026-5192 7.5 daroo May 4, 2026
5 Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter CVE-2026-2729 5.3 Kittipat Jitphonchana May 4, 2026
6 Forminator <= 1.50.2 - Missing Authorization CVE-2026-32409 5.3 Nguyen Tien Dung February 22, 2026
7 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting CVE-2026-2002 4.4 Tiến Dũng Nguyễn February 16, 2026
8 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export CVE-2025-14782 5.3 type5afe January 8, 2026
9 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter CVE-2025-7638 4.9 Chive July 17, 2025
10 Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion CVE-2025-6464 7.5 Phat RiO July 1, 2025
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation