Hur vet jag om min sajt är påverkad?

Kör ett gratis test på sitesupport.co/testa-din-hemsida. Testet kontrollerar vilka tillägg och versioner du använder och jämför mot kända sårbarheter.

Vad ska jag göra om jag har en sårbar version?

Uppdatera till senaste versionen så snart som möjligt. Om ingen fix finns tillgänglig, överväg att tillfälligt inaktivera tillägget.

Forminator Forms – Contact Form, Payment Form & Custom Form Builder

Name: Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Rating: 4.8

4.8/5

600 000+ installationer

Best WordPress form builder plugin. Create contact forms, payment forms & order forms with 1000+ integrations.

Kända sårbarheter

Kritiska / höga

2026-02-19

Senaste sårbarhet

600 000+

Aktiva installationer

Om Forminator Forms – Contact Form, Payment Form & Custom Form Builder

Forminator Forms är ett populärt WordPress-tillägg med över 600 000 aktiva installationer som används för att skapa kontaktformulär, betalningsformulär och anpassade formulär med över 1000 integrationer.

Säkerhetsläget för Forminator Forms

Tillägget har totalt 27 dokumenterade sårbarheter, vilket är ett relativt högt antal för ett så använt tillägg. Fördelningen visar 2 kritiska, 5 höga, 19 medelhöga och 1 låg allvarlighetsgrad. De kritiska och höga sårbarheterna kan potentiellt leda till obehörig åtkomst eller dataläckor.

Praktiska risker

Med tanke på att formulärtillägg ofta hanterar känslig användardata som kontaktuppgifter och ibland betalningsinformation, är säkerheten extra viktig. De högre sårbarhetsgraderna kan utgöra reella risker för webbplatser som samlar in personuppgifter eller processar betalningar.

Rekommendationer

Håll alltid tillägget uppdaterat till senaste versionen
Överväg alternativa formulärtillägg med bättre säkerhetshistorik för känsliga användningsområden
Implementera extra säkerhetslager som brandvägg för webbapplikationer
Övervaka regelbundet för säkerhetsuppdateringar

Regelbundna uppdateringar är det mest effektiva skyddet mot kända sårbarheter och bör alltid prioriteras för att hålla din WordPress-installation säker.

Använder du Forminator Forms – Contact Form, Payment Form & Custom Form Builder?

Kör ett gratis test och se om din hemsida är påverkad av dessa sårbarheter.

Testa din hemsida

Alla kända sårbarheter

Hög 2026-02-19 CVE-2025-12845

CVE-2025-12845: The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads to privilege escalation due to a m...

Påverkade versioner: <= 1.50.3

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads to privilege escalation due to a missing capability check on the get_table_data() function...

Medel 2026-02-17 CVE-2026-2002

CVE-2026-2002: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form_name parameter in all versions up to, and in...

Påverkade versioner: <= 1.50.3

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form_name parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization...

Medel 2026-02-16 CVE-2026-2002

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.50.2 - Authenticated (Administrator+) Stored Cross-Site Scripting

Påverkade versioner: <= 1.50.2

Medel 2026-01-09 CVE-2025-14782

CVE-2025-14782: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via the 'listen_for...

Påverkade versioner: all

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.49.1 via the 'listen_for_csv_export' function. This is due to the plugin not pr...

Medel 2026-01-08 CVE-2025-14782

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export

Påverkade versioner: <= 1.49.1

Kritisk 2025-11-01 CVE-2025-11499

CVE-2025-11499: The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_fea...

Påverkade versioner: all

The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the set_featured_image_from_external_url() function in all versions...

Medel 2025-07-18 CVE-2025-7638

CVE-2025-7638: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the `order_by` parameter in all versions up to, and incl...

Påverkade versioner: all

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the `order_by` parameter in all versions up to, and including, 1.45.0 due to insufficient escaping on the user...

Medel 2025-07-17 CVE-2025-7638

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.45.0 - Authenticated (Administrator+) SQL Injection via `order_by` Parameter

Påverkade versioner: <= 1.45.0

Hög 2025-07-02 CVE-2025-6464

CVE-2025-6464: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization...

Påverkade versioner: < 1.44.3

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files'...

Hög 2025-07-02 CVE-2025-6463

CVE-2025-6463: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete...

Påverkade versioner: < 1.44.3

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and incl...

Hög 2025-07-01 CVE-2025-6464

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion

Påverkade versioner: <= 1.44.2

Hög 2025-07-01 CVE-2025-6463

Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion

Påverkade versioner: <= 1.44.2

Medel 2025-06-05 CVE-2025-5341

CVE-2025-5341: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versio...

Påverkade versioner: < 1.44.2

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input s...

Medel 2025-06-04 CVE-2025-5341

Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters

Påverkade versioner: <= 1.44.1

Medel 2025-04-17 CVE-2025-3479

CVE-2025-3479: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_sing...

Påverkade versioner: < 1.42.1

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Order Replay in all versions up to, and including, 1.42.0 via the 'handle_stripe_single' function due to insufficient validation on a user c...

Medel 2025-04-17 CVE-2025-3487

CVE-2025-3487: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and ...

Påverkade versioner: < 1.42.1

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘limit’ parameter in all versions up to, and including, 1.42.0 due to insufficient input sanitization an...

Medel 2025-04-16 CVE-2025-3487

Forminator <= 1.42.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit'

Påverkade versioner: <= 1.42.0

Medel 2025-04-16 CVE-2025-3479

Forminator <= 1.42.0 - Order Replay Vulnerability

Påverkade versioner: <= 1.42.0

Medel 2025-02-27 CVE-2025-0469

CVE-2025-0469: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and i...

Påverkade versioner: < 1.39.3

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider template data in all versions up to, and including, 1.39.2 due to insufficient input sanitization...

Medel 2025-02-14 CVE-2024-7052

CVE-2024-7052: The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting a...

Påverkade versioner: < 1.38.3

The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is di...

Medel 2025-01-31 CVE-2025-0470

CVE-2025-0470: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and inc...

Påverkade versioner: < 1.38.3

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title parameter in all versions up to, and including, 1.38.2 due to insufficient input sanitization a...

Medel 2024-10-31 CVE-2024-9700

CVE-2024-9700: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.36.0 via the...

Påverkade versioner: < 1.36.1

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.36.0 via the submit_quizzes() function due to missing validation on...

Hög 2024-10-26 CVE-2024-10402

CVE-2024-10402: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions u...

Påverkade versioner: < 1.36.0

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for...

Medel 2024-10-17 CVE-2024-9352

CVE-2024-9352: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due ...

Påverkade versioner: < 1.36.0

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due to missing or incorrect nonce validation on the custom...

Medel 2024-10-17 CVE-2024-9351

CVE-2024-9351: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.35.1. This is due ...

Påverkade versioner: < 1.36.0

Hög 2024-08-02 CVE-2024-7389

CVE-2024-7389: The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possibl...

Påverkade versioner: < 1.29.2

The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpo...

Medel 2024-04-09 CVE-2024-3053

CVE-2024-3053: The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ forminator_form shortcode attribute in version...

Påverkade versioner: < 1.29.3

The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ forminator_form shortcode attribute in versions up to, and including, 1.29.2 due to insufficient input sa...

Medel 2024-04-09 CVE-2024-1794

CVE-2024-1794: The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and including, 1.29.0 due to insufficient input sanitiz...

Påverkade versioner: <= 1.29.1

The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. 3gpp file) in all versions up to, and including, 1.29.0 due to insufficient input sanitization and output escaping. This makes it possible for...

Medel 2023-11-20 CVE-2023-5119

CVE-2023-5119: The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to i...

Påverkade versioner: < 1.27.0

The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_...

Medel 2023-11-15 CVE-2023-6133

CVE-2023-6133: The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in versions up to, and including, 1.27.0...

Påverkade versioner: <= 1.27.0

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in versions up to, and including, 1.27.0. This makes it possible for authenticated attackers...

Kritisk 2023-08-30 CVE-2023-4596

CVE-2023-4596: The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in...

Påverkade versioner: <= 1.24.6

The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it...

Medel 2023-07-31 CVE-2023-3134

CVE-2023-3134: The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS ...

Påverkade versioner: < 1.24.4

The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.

Medel 2023-07-12 CVE-2021-4417

CVE-2021-4417: The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.13.4. This is due to missing...

Påverkade versioner: < 1.13.5

The Forminator – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.13.4. This is due to missing or incorrect nonce validation on the listen_for_saving...

Låg 2023-07-04 CVE-2023-2010

CVE-2023-2010: The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may a...

Påverkade versioner: < 1.24.1

The Forminator WordPress plugin before 1.24.1 does not use an atomic operation to check whether a user has already voted, and then update that information. This leads to a Race Condition that may allow a single user to vote multiple times on a poll.

Medel 2021-11-23 CVE-2021-24700

CVE-2021-24700: The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilt...

Påverkade versioner: < 1.15.4

The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed

Så skyddar du din sajt

Sårbarheter i tillägg är den vanligaste attackytan för WordPress-sajter. Det bästa skyddet är att vara proaktiv — här är tre konkreta steg.

Håll tillägget uppdaterat

De flesta sårbarheter i Forminator Forms – Contact Form, Payment Form & Custom Form Builder åtgärdas snabbt av utvecklarna. Uppdatera alltid till senaste versionen.

Ta bort oanvända tillägg

Varje tillägg är en potentiell attackyta. Avinstallera det du inte aktivt använder.

Bevaka automatiskt

Med löpande övervakning upptäcker du problem innan de blir allvarliga.

Vill du slippa hålla koll själv? Med ett supportavtal från Sitesupport sköter vi uppdateringar och säkerhet åt dig.

Vanliga frågor om Forminator Forms – Contact Form, Payment Form & Custom Form Builder

Forminator Forms – Contact Form, Payment Form & Custom Form Builder har 35 kända sårbarheter, varav 9 med hög eller kritisk allvarlighetsgrad. Det betyder inte nödvändigtvis att tillägget är osäkert — de flesta sårbarheter åtgärdas i nya versioner. Det viktigaste är att alltid köra den senaste versionen.

Det enklaste sättet är att köra ett gratis test av din hemsida på sitesupport.co. Testet kontrollerar vilka tillägg du använder och vilka versioner som är installerade, och jämför det mot kända sårbarheter.

Uppdatera till den senaste versionen så snart som möjligt. Om det inte finns en uppdatering som åtgärdar problemet bör du överväga att tillfälligt inaktivera tillägget, särskilt om sårbarheten har kritisk eller hög allvarlighetsgrad.

Forminator Forms – Contact Form, Payment Form & Custom Form Builder har över 600 000 aktiva installationer på WordPress.org och ett betyg på 4.8 av 5. Populära tillägg har generellt bättre säkerhetsrutiner tack vare större community och fler ögon på koden.