Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Forminator Forms – Contact Form, Payment Form & Custom Form Builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 44 vulnerability records associated with Forminator Forms – Contact Form, Payment Form & Custom Form Builder, published between 2019 and 2026.

Dataset last synchronized: 2026-08-02 09:41:47 UTC

At a glance

Security Snapshot

44Total records
3Critical
10High
31Medium
0Low
0Informational
44Patched records
0Currently marked unpatched
2019-02-06First disclosure
2026-07-08Latest disclosure
41 of 44CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
201922 records
202133 records
202388 records
20241212 records
202599 records
20261010 records

Severity Breakdown

SeverityRecordsShare
Critical36.8%
High1022.7%
Medium3170.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

18 records40.9%

First: 2019. Latest: 2026.

Missing Authorization

10 records22.7%

First: 2023. Latest: 2026.

SQL Injection

3 records6.8%

First: 2019. Latest: 2025.

CSRF

3 records6.8%

First: 2021. Latest: 2024.

Other

3 records6.8%

First: 2023. Latest: 2025.

Arbitrary File Upload

3 records6.8%

First: 2023. Latest: 2024.

Path Traversal

3 records6.8%

First: 2025. Latest: 2026.

Information Disclosure

1 record2.3%

First: 2024. Latest: 2024.

Patch Status

Patched
44
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 1.55.0.2
  • 1.55.1
  • 1.53.2
  • 1.53.0.1
  • 1.52
  • 1.52.2
  • 1.52.1
  • 1.50.3
  • 1.49.2
  • 1.45.1
  • 1.44.3
  • 1.44.2
  • 1.42.1
  • 1.39.3
  • 1.38.3
  • 1.36.1
  • 1.36.0
  • 1.34.1
  • 1.29.2
  • 1.29.0
  • 1.15.4
  • 1.29.3
  • 1.29.1
  • 1.28.0
  • 1.27.0
  • 1.25.0
  • 1.24.4
  • 1.24.1
  • 1.23.3
  • 1.14.12
  • 1.13.5
  • 1.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
*-1.28.1Forminator <= 1.28.1 - Unauthenticated Arbitrary File UploadApril 18, 20241.29.0Critical
*-1.15.2Forminator <= 1.15.2 - Reflected Cross-Site ScriptingApril 18, 20241.15.4Medium
*-1.29.2Forminator <= 1.29.2 - Authenticated (Admin+) SQL InjectionApril 18, 20241.29.3Critical
*-1.29.2Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.29.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form ShortcodeApril 8, 20241.29.3Medium
*-1.29.0Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File UploadMarch 29, 20241.29.1High
*-1.29.0Forminator <= 1.29.0 - Reflected Cross-Site ScriptingMarch 25, 20241.29.1Medium
*-1.27.0Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File UploadNovember 14, 20231.28.0Medium
*-1.26.0Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.27.0 - Authenticated (Admin+) Stored Cross-Site ScriptingOctober 27, 20231.27.0Medium
*-1.24.6Forminator <= 1.24.6 - Unauthenticated Arbitrary File UploadAugust 29, 20231.25.0Critical
*-1.24.1Forminator <= 1.24.1 - Reflected Cross-Site ScriptingJuly 10, 20231.24.4Medium
*-1.23.3Forminator <= 1.23.3 - Race Condition to Multiple Poll VotingJune 12, 20231.24.1Medium
*-1.22.1Forminator <= 1.22.1 - Missing Authorization on 'hubspot_support_request' AJAX functionApril 12, 20231.23.3Medium
*-1.22.1Forminator <= 1.22.1 - Missing Authorization on 'load_recaptcha_preview' AJAX functionApril 12, 20231.23.3Medium
*-1.22.1Forminator <= 1.22.1 - Missing Authorization on 'load_hcaptcha_preview' AJAX functionApril 12, 20231.23.3Medium
[*, 1.15.4)Forminator <= 1.15.2 - Admin+ Stored Cross-Site ScriptingOctober 20, 20211.15.4Medium
[*, 1.14.12)Forminator <= 1.14.11 - Unauthenticated Stored Cross-Site ScriptingJuly 14, 20211.14.12High
[*, 1.13.5)Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.13.4 - Cross-Site Request Forgery BypassMarch 1, 20211.13.5Medium
[*, 1.6)Forminator Plugin <= 1.5.3.1 - SQL InjectionFebruary 6, 20191.6Medium
[*, 1.6)Forminator Plugin <= 1.5.4 - Cross-Site ScriptingFebruary 6, 20191.6Medium

Selected source records

Latest Records

HighCVE-2026-57815

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.2 - Unauthenticated Arbitrary File Download

Published: July 8, 2026

Affected versions
*-1.55.0.2
Patched versions
1.55.1
Original Wordfence record
HighCVE-2026-57814

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.1 - Unauthenticated Stored Cross-Site Scripting

Published: July 8, 2026

Affected versions
*-1.55.0.1
Patched versions
1.55.0.2
Original Wordfence record
HighCVE-2026-56071

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.53.1 - Unauthenticated Stored Cross-Site Scripting

Published: June 24, 2026

Affected versions
*-1.53.1
Patched versions
1.53.2
Original Wordfence record
MediumCVE-2026-6214

Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook

Published: May 6, 2026

Affected versions
*-1.53.0
Patched versions
1.53.0.1
Original Wordfence record
MediumCVE-2026-6222

Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter

Published: May 6, 2026

Affected versions
*-1.51.1
Patched versions
1.52
Original Wordfence record
HighCVE-2026-5192

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'

Published: May 4, 2026

Affected versions
*-1.52.1
Patched versions
1.52.2
Original Wordfence record
MediumCVE-2026-2729

Forminator – Contact Form, Payment Form & Custom Form Builder <= 1.52.0 - Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter

Published: May 4, 2026

Affected versions
*-1.52.0
Patched versions
1.52.1
Original Wordfence record
MediumCVE-2026-32409

Forminator <= 1.50.2 - Missing Authorization

Published: February 22, 2026

Affected versions
*-1.50.2
Patched versions
1.50.3
Original Wordfence record

Highest-Severity Records

CriticalCVE-2023-4596

Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

Published: August 29, 2023

Affected versions
*-1.24.6
Patched versions
1.25.0
Original Wordfence record
CriticalCVE-2024-28890

Forminator <= 1.28.1 - Unauthenticated Arbitrary File Upload

Published: April 18, 2024

Affected versions
*-1.28.1
Patched versions
1.29.0
Original Wordfence record
CriticalCVE-2024-31077

Forminator <= 1.29.2 - Authenticated (Admin+) SQL Injection

Published: April 18, 2024

Affected versions
*-1.29.2
Patched versions
1.29.3
Original Wordfence record
HighCVE-2025-6463

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion

Published: July 1, 2025

Affected versions
*-1.44.2
Patched versions
1.44.3
Original Wordfence record
HighCVE-2024-7389

Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure

Published: August 1, 2024

Affected versions
*-1.29.1
Patched versions
1.29.2
Original Wordfence record
HighCVE-2026-57815

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.2 - Unauthenticated Arbitrary File Download

Published: July 8, 2026

Affected versions
*-1.55.0.2
Patched versions
1.55.1
Original Wordfence record
HighCVE-2025-6464

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion

Published: July 1, 2025

Affected versions
*-1.44.2
Patched versions
1.44.3
Original Wordfence record
HighCVE-2026-5192

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'

Published: May 4, 2026

Affected versions
*-1.52.1
Patched versions
1.52.2
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory