https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-6464.htmlhttps://patchthecve.com/cve/CVE-2025-6464.htmlWed, 17 Jun 2026 10:01:56 +0000HIGH 7.5: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function. This makes it possible for unauthenticathttps://patchthecve.com/cve/CVE-2025-6463.htmlhttps://patchthecve.com/cve/CVE-2025-6463.htmlWed, 17 Jun 2026 10:01:56 +0000HIGH 8.8: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.44.2. This makes it possible for unauthenhttps://patchthecve.com/cve/CVE-2024-45625.htmlhttps://patchthecve.com/cve/CVE-2024-45625.htmlWed, 17 Jun 2026 07:54:35 +0000MEDIUM 6.1: Cross-site scripting vulnerability exists in Forminator versions prior to 1.34.1. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who follows a crafted URL and accesses the webpage with the web form created by Forminator.https://patchthecve.com/cve/CVE-2024-7389.htmlhttps://patchthecve.com/cve/CVE-2024-7389.htmlWed, 17 Jun 2026 08:20:00 +0000HIGH 7.5: The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integration developer API key and make unauthori