Stored Cross-Site Scripting Vulnerability in Forminator Forms Plugin for WordPress
CVE-2025-3487
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 17 April 2025
What is CVE-2025-3487?
The Forminator Forms plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability via the 'limit' parameter due to inadequate input sanitization and output escaping. This issue affects all versions up to and including 1.42.0, allowing authenticated attackers, with Contributor-level access or higher, to inject arbitrary web scripts. These scripts can execute on pages when other users access them, potentially leading to unauthorized actions or data exposure.
Affected Version(s)
Forminator Forms – Contact Form, Payment Form & Custom Form Builder * <= 1.42.0