CVE-2023-3134: Incsub Forminator

Medium severity, CVSS 6.1. EPSS: 4.1% chance of exploitation in the next 30 days.

The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form fields that use pre-populated query parameters, which could lead to reflected XSS attacks.

Affected products

• Incsub Forminator: before 1.24.4 (fixed in 1.24.4)

Published 2023-07-31. Last modified 2026-06-17.