Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Forminator Forms – Contact Form, Payment Form & Custom Form Builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 44 vulnerability records associated with Forminator Forms – Contact Form, Payment Form & Custom Form Builder, published between 2019 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

44Total records
3Critical
10High
31Medium
0Low
0Informational
44Patched records
0Currently marked unpatched
2019-02-06First disclosure
2026-07-08Latest disclosure
41 of 44CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201922 records
202133 records
202388 records
20241212 records
202599 records
20261010 records

Severity Breakdown

SeverityRecordsShare
Critical36.8%
High1022.7%
Medium3170.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

18 records40.9%

First: 2019. Latest: 2026.

Missing Authorization

10 records22.7%

First: 2023. Latest: 2026.

SQL Injection

3 records6.8%

First: 2019. Latest: 2025.

CSRF

3 records6.8%

First: 2021. Latest: 2024.

Other

3 records6.8%

First: 2023. Latest: 2025.

Arbitrary File Upload

3 records6.8%

First: 2023. Latest: 2024.

Path Traversal

3 records6.8%

First: 2025. Latest: 2026.

Information Disclosure

1 record2.3%

First: 2024. Latest: 2024.

Patch Status

Patched
44
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 1.55.0.2
  • 1.55.1
  • 1.53.2
  • 1.53.0.1
  • 1.52
  • 1.52.2
  • 1.52.1
  • 1.50.3
  • 1.49.2
  • 1.45.1
  • 1.44.3
  • 1.44.2
  • 1.42.1
  • 1.39.3
  • 1.38.3
  • 1.36.1
  • 1.36.0
  • 1.34.1
  • 1.29.2
  • 1.29.0
  • 1.15.4
  • 1.29.3
  • 1.29.1
  • 1.28.0
  • 1.27.0
  • 1.25.0
  • 1.24.4
  • 1.24.1
  • 1.23.3
  • 1.14.12
  • 1.13.5
  • 1.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-1.55.0.1Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.1 - Unauthenticated Stored Cross-Site ScriptingJuly 8, 20261.55.0.2High
*-1.55.0.2Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.2 - Unauthenticated Arbitrary File DownloadJuly 8, 20261.55.1High
*-1.53.1Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.53.1 - Unauthenticated Stored Cross-Site ScriptingJune 24, 20261.53.2High
*-1.53.0Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded HookMay 6, 20261.53.0.1Medium
*-1.51.1Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' ParameterMay 6, 20261.52Medium
*-1.52.1Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'May 4, 20261.52.2High
*-1.52.0Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' ParameterMay 4, 20261.52.1Medium
*-1.50.2Forminator <= 1.50.2 - Missing AuthorizationFebruary 22, 20261.50.3Medium
*-1.50.2Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site ScriptingFebruary 16, 20261.50.3Medium
*-1.49.1Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV ExportJanuary 8, 20261.49.2Medium
*-1.45.0Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` ParameterJuly 17, 20251.45.1Medium
*-1.44.2Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission DeletionJuly 1, 20251.44.3High
*-1.44.2Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission DeletionJuly 1, 20251.44.3High
*-1.44.1Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size ParametersJune 4, 20251.44.2Medium
*-1.42.0Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'April 16, 20251.42.1Medium
*-1.42.0Forminator <= 1.42.0 - Order Replay VulnerabilityApril 16, 20251.42.1Medium
1.39.2Forminator <= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingFebruary 26, 20251.39.3Medium
*-1.38.2Forminator <= 1.38.2 - Reflected Cross-Site Scripting via Title ParameterJanuary 30, 20251.38.3Medium
*-1.38.2Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.38.2 - Authenticated (Admin+) Stored Cross-Site ScriptingJanuary 24, 20251.38.3Medium
*-1.36.0Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.36.0 - Insecure Direct Object Reference to Submission ManipulationOctober 30, 20241.36.1Medium
*-1.35.1Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and CreationOctober 25, 20241.36.0High
*-1.35.1Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Quiz CreationOctober 16, 20241.36.0Medium
*-1.35.1Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Cross-Site Request Forgery to Draft Custom Form CreationOctober 16, 20241.36.0Medium
*-1.34.0Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.34.0 - Reflected Cross-Site ScriptingSeptember 9, 20241.34.1Medium
*-1.29.1Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information ExposureAugust 1, 20241.29.2High

Selected source records

Latest Records

HighCVE-2026-57815

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.2 - Unauthenticated Arbitrary File Download

Published: July 8, 2026

Affected versions
*-1.55.0.2
Patched versions
1.55.1
Original Wordfence record
HighCVE-2026-57814

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.1 - Unauthenticated Stored Cross-Site Scripting

Published: July 8, 2026

Affected versions
*-1.55.0.1
Patched versions
1.55.0.2
Original Wordfence record
HighCVE-2026-56071

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.53.1 - Unauthenticated Stored Cross-Site Scripting

Published: June 24, 2026

Affected versions
*-1.53.1
Patched versions
1.53.2
Original Wordfence record
MediumCVE-2026-6214

Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook

Published: May 6, 2026

Affected versions
*-1.53.0
Patched versions
1.53.0.1
Original Wordfence record
MediumCVE-2026-6222

Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter

Published: May 6, 2026

Affected versions
*-1.51.1
Patched versions
1.52
Original Wordfence record
HighCVE-2026-5192

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'

Published: May 4, 2026

Affected versions
*-1.52.1
Patched versions
1.52.2
Original Wordfence record
MediumCVE-2026-2729

Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter

Published: May 4, 2026

Affected versions
*-1.52.0
Patched versions
1.52.1
Original Wordfence record
MediumCVE-2026-32409

Forminator <= 1.50.2 - Missing Authorization

Published: February 22, 2026

Affected versions
*-1.50.2
Patched versions
1.50.3
Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-4596

Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

Published: August 29, 2023

Affected versions
*-1.24.6
Patched versions
1.25.0
Original Wordfence record
CriticalCVE-2024-28890

Forminator <= 1.28.1 - Unauthenticated Arbitrary File Upload

Published: April 18, 2024

Affected versions
*-1.28.1
Patched versions
1.29.0
Original Wordfence record
CriticalCVE-2024-31077

Forminator <= 1.29.2 - Authenticated (Admin+) SQL Injection

Published: April 18, 2024

Affected versions
*-1.29.2
Patched versions
1.29.3
Original Wordfence record
HighCVE-2025-6463

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion

Published: July 1, 2025

Affected versions
*-1.44.2
Patched versions
1.44.3
Original Wordfence record
HighCVE-2024-7389

Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

Published: August 1, 2024

Affected versions
*-1.29.1
Patched versions
1.29.2
Original Wordfence record
HighCVE-2026-57815

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.2 - Unauthenticated Arbitrary File Download

Published: July 8, 2026

Affected versions
*-1.55.0.2
Patched versions
1.55.1
Original Wordfence record
HighCVE-2025-6464

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion

Published: July 1, 2025

Affected versions
*-1.44.2
Patched versions
1.44.3
Original Wordfence record
HighCVE-2026-5192

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'

Published: May 4, 2026

Affected versions
*-1.52.1
Patched versions
1.52.2
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory