4.8Medium

CVE-2024-7052Forminator < 1.38.3 - Admin+ Stored XSS

Forminator Forms Published: 2025-02-14 09:00 (1 year ago)

Description

The Forminator Forms WordPress plugin before 1.38.3 does not sanitise and escape some of its settings, which could allow high privilege users such as Admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

Weakness (CWE): CWE-79

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
—	Forminator Forms	< 1.38.3
wpmudev	forminator forms	< 1.38.3

References and patches

https://wpscan.com/vulnerability/4e52cab5-821c-4ca8-9024-67f716cf78fe/ exploitvdb-entrytechnical-descriptionExploit

CPE matches (NVD) (1)

cpe:2.3:a:wpmudev:forminator_forms:*:*:*:*:free:wordpress:*:* < 1.38.3

CVSS score

4.8Medium

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: High
User interaction: Required
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: None

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

All scores (2)

CISA-ADP	CVSS 3.1	4.8Medium
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	4.8Medium

EPSS (chance of exploitation in 30 days)

0.33%

higher than 27% of all CVEs

CISA assessment (SSVC)

Exploitation: poc
Automatable: no
Technical impact: partial

Timeline

ID reserved2024-07-23
Published2025-02-14 09:00
Reached IP-DB2026-10-24 23:57
Last updated2026-06-17 11:19

Assigned by (CNA): WPScan
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

6.5Medium

CVE-2026-125800 1 hour ago

WordPress Spectra plugin <= 2.20.5 - Cross Site Scripting (XSS) vulnerability

Brainstorm Force Spectra

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5.

6.5Medium

CVE-2026-125801 1 hour ago

WordPress WooCommerce plugin 11.0.0-11.2.2 - Race Condition vulnerability

Automattic WooCommerce

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Automattic WooCommerce woocommerce allows Leveraging Race Conditions.This issue affects WooCommerce: from 11.0.0 through 11.2.2.

5.3Medium

CVE-2026-105880 1 hour ago

WordPress WebinarIgnition plugin <= 4.27.125 - Insecure Direct Object References (IDOR) vulnerability

Tobias WebinarIgnition

Authorization Bypass Through User-Controlled Key vulnerability in Tobias WebinarIgnition webinar-ignition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarIgnition: from n/a through 4.27.125.

5.3Medium

CVE-2026-112830 1 hour ago

WordPress Brizy plugin <= 2.8.25 - Broken Access Control vulnerability

Brizy Brizy

Missing Authorization vulnerability in Brizy Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through 2.8.25.

6.5Medium

CVE-2026-125816 1 hour ago

WordPress MapSVG plugin <= 9.0.4 - Cross Site Scripting (XSS) vulnerability

PT Norther Lights Production MapSVG

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 9.0.4.

6.5Medium

CVE-2026-119518 1 hour ago

WordPress Royal Elementor Addons plugin <= 1.7.1070 - Cross Site Scripting (XSS) vulnerability

WProyal Royal Elementor Addons

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1070.