Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.4
CVE-2024-31857: Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the u...
CVE-2024-31857 · published 2 years ago
Summary
Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the user's web browser.
What to do
- Update incsub forminator to version 1.15.4 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| incsub | forminator |
< 1.15.4 cpe:2.3:a:incsub:forminator:*:*:*:*:free:wordpress:*:* |
Original advisory text
Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the u...
Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the user's web browser.
References
- https://jvn.jp/en/jp/JVN50132400/ Third Party Advisory
- https://wordpress.org/plugins/forminator/ Product
- https://wpmudev.com/ Product
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published23 Apr 2024
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-31857 · NVD
Track software like this
Free during beta