https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-5341.htmlhttps://patchthecve.com/cve/CVE-2025-5341.htmlWed, 17 Jun 2026 09:47:43 +0000MEDIUM 6.4: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it poshttps://patchthecve.com/cve/CVE-2025-3487.htmlhttps://patchthecve.com/cve/CVE-2025-3487.htmlWed, 17 Jun 2026 09:20:02 +0000MEDIUM 6.4: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and including, 1.42.0 due to insufficient input sanitization and output escaping. This makes it possible for authhttps://patchthecve.com/cve/CVE-2025-3479.htmlhttps://patchthecve.com/cve/CVE-2025-3479.htmlWed, 17 Jun 2026 09:20:01 +0000MEDIUM 5.3: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user controlled key. This makes it possible for unauthenhttps://patchthecve.com/cve/CVE-2025-0469.htmlhttps://patchthecve.com/cve/CVE-2025-0469.htmlWed, 17 Jun 2026 08:26:32 +0000MEDIUM 6.4: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and including, 1.39.2 due to insufficient input sanitization and output escaping. This makes it possible for ahttps://patchthecve.com/cve/CVE-2024-7052.htmlhttps://patchthecve.com/cve/CVE-2024-7052.htmlWed, 17 Jun 2026 08:19:16 +0000MEDIUM 4.8: The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)https://patchthecve.com/cve/CVE-2025-0470.htmlhttps://patchthecve.com/cve/CVE-2025-0470.htmlWed, 17 Jun 2026 08:26:32 +0000MEDIUM 6.1: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization and output escaping. This makes it possible for unahttps://patchthecve.com/cve/CVE-2024-9700.htmlhttps://patchthecve.com/cve/CVE-2024-9700.htmlWed, 17 Jun 2026 08:25:05 +0000MEDIUM 5.3: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.36.0 via the submit_quizzes() function due to missing validation on the 'entry_id' user controlled key. This makes ithttps://patchthecve.com/cve/CVE-2024-10402.htmlhttps://patchthecve.com/cve/CVE-2024-10402.htmlWed, 17 Jun 2026 06:55:33 +0000HIGH 7.5: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenticated attackers, with Contributor-level ahttps://patchthecve.com/cve/CVE-2024-9352.htmlhttps://patchthecve.com/cve/CVE-2024-9352.htmlWed, 17 Jun 2026 08:24:24 +0000MEDIUM 4.3: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the custom form 'create_module' function. This makes it possihttps://patchthecve.com/cve/CVE-2024-9351.htmlhttps://patchthecve.com/cve/CVE-2024-9351.htmlWed, 17 Jun 2026 08:24:23 +0000MEDIUM 4.3: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the quiz 'create_module' function. This makes it possible for