Unauthenticated attackers can submit forged array values for Select, Radio and Checkbox fields, including a forged upload record, which bypass sanitization and are stored with the form entry. The stored content can execute JavaScript when an administrator views the submission. Sites running Forminator Forms 1.56.1 and earlier are affected.
This vulnerability affects the following application versions:
- Forminator Forms 1.13.4
- Forminator Forms 1.14.6
- Forminator Forms 1.14.7
- Forminator Forms 1.14.8
- Forminator Forms 1.14.8.1
- Forminator Forms 1.14.9
- Forminator Forms 1.14.10.1
- Forminator Forms 1.14.11
- Forminator Forms 1.14.12
- Forminator Forms 1.14.12.1
- Forminator Forms 1.15.0.1
- Forminator Forms 1.15.2
- Forminator Forms 1.15.4
- Forminator Forms 1.15.7
- Forminator Forms 1.15.9
- Forminator Forms 1.15.11
- Forminator Forms 1.15.12
- Forminator Forms 1.15.13
- Forminator Forms 1.15.14
- Forminator Forms 1.16.2
- Forminator Forms 1.17.1
- Forminator Forms 1.17.2
- Forminator Forms 1.18.1
- Forminator Forms 1.18.2
- Forminator Forms 1.19.0
- Forminator Forms 1.20.1
- Forminator Forms 1.21.0
- Forminator Forms 1.22.1
- Forminator Forms 1.23.3
- Forminator Forms 1.24.1
- Forminator Forms 1.24.4
- Forminator Forms 1.24.5
- Forminator Forms 1.24.6
- Forminator Forms 1.25.0
- Forminator Forms 1.25.1
- Forminator Forms 1.25.2
- Forminator Forms 1.26.0
- Forminator Forms 1.27.0
- Forminator Forms 1.28.0
- Forminator Forms 1.28.1
- Forminator Forms 1.29.0
- Forminator Forms 1.29.2
- Forminator Forms 1.29.3
- Forminator Forms 1.30.2
- Forminator Forms 1.31.0
- Forminator Forms 1.32.0
- Forminator Forms 1.33.0
- Forminator Forms 1.34.0
- Forminator Forms 1.34.1
- Forminator Forms 1.35.0
- Forminator Forms 1.35.1
- Forminator Forms 1.36.0
- Forminator Forms 1.36.1
- Forminator Forms 1.36.2
- Forminator Forms 1.36.3
- Forminator Forms 1.37.1
- Forminator Forms 1.38.1
- Forminator Forms 1.38.2
- Forminator Forms 1.38.3
- Forminator Forms 1.39.0
- Forminator Forms 1.39.1
- Forminator Forms 1.39.2
- Forminator Forms 1.39.3
- Forminator Forms 1.40.0
- Forminator Forms 1.41.1
- Forminator Forms 1.41.2
- Forminator Forms 1.42.0
- Forminator Forms 1.42.1
- Forminator Forms 1.42.2
- Forminator Forms 1.43.0
- Forminator Forms 1.43.1
- Forminator Forms 1.44
- Forminator Forms 1.44.1
- Forminator Forms 1.44.2
- Forminator Forms 1.44.3
- Forminator Forms 1.45
- Forminator Forms 1.45.1
- Forminator Forms 1.46.1
- Forminator Forms 1.46.2
- Forminator Forms 1.47
- Forminator Forms 1.48.2
- Forminator Forms 1.48.3
- Forminator Forms 1.49.0
- Forminator Forms 1.49.2
- Forminator Forms 1.50.1
- Forminator Forms 1.50.3
- Forminator Forms 1.51
- Forminator Forms 1.51.1
- Forminator Forms 1.52
- Forminator Forms 1.52.1
- Forminator Forms 1.52.2
- Forminator Forms 1.53.0
- Forminator Forms 1.53.0.1
- Forminator Forms 1.53.1
- Forminator Forms 1.53.2
- Forminator Forms 1.54
- Forminator Forms 1.54.0
- Forminator Forms 1.55.0
- Forminator Forms 1.55.0.1
- Forminator Forms 1.55.0.2
- Forminator Forms 1.55.1
- Forminator Forms 1.56.0
- Forminator Forms 1.56.0.1
- Forminator Forms 1.56.0.2
- Forminator Forms 1.56.1