Incsub vulnerabilities
We track 6 vulnerabilities in Incsub products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on July 2, 2025.
Latest Incsub vulnerabilities
- 8.8 High severity
Forminator Forms – Contact Form, Payment Form…: Deserialization of Untrusted Data
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.44.2 via deserialization of untrusted input in the 'entry_delete_upload_files' function.
- 8.8 High severity
Forminator Forms – Contact Form, Payment Form…: External Control of File Name or Path
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'entry_delete_upload_files' function in all versions up to, and including, 1.4
- 8.8 High severity
Forminator Forms – Contact Form, Payment Form…: Missing Authorization
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authentic
- 7.5 High severity
Forminator Forms – Contact Form, Payment Form…: Insufficiently Protected Credentials
The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.29.1 via class-forminator-addon-hubspot-wp-api.php. This makes it possible for unauthenticated attackers to extract the HubSpot integrat
- 7.2 High severity
Forminator: Improper Neutralization of Special Elements used in an SQL Command
Forminator prior to 1.29.3 contains a SQL injection vulnerability. If this vulnerability is exploited, a remote authenticated attacker with an administrative privilege may obtain and alter any information in the database and cause a denial-of-service (DoS) con
- 9.8 Critical severity
Forminator Forms – Contact Form, Payment Form…: Unrestricted Upload of File with Dangerous Type
The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible