CVE-2019-9567

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a poll.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.openwall.net/full-disclosure/2019/02/05/4Exploit, Third Party Advisory
https://security-consulting.icu/blog/2019/02/wordpress-forminator-persistent-xss-blind-sql-injection/Exploit, Third Party Advisory
https://wordpress.org/plugins/forminator/#developersVendor Advisory
https://wpvulndb.com/vulnerabilities/9215Third Party Advisory
https://lists.openwall.net/full-disclosure/2019/02/05/4Exploit, Third Party Advisory
https://security-consulting.icu/blog/2019/02/wordpress-forminator-persistent-xss-blind-sql-injection/Exploit, Third Party Advisory
https://wordpress.org/plugins/forminator/#developersVendor Advisory
https://wpvulndb.com/vulnerabilities/9215Third Party Advisory

Timeline

Published: Mar 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-95686.5The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/admin.php?page=formina CVE-2019-95699.8Buffer Overflow in dactetra in Delta Controls enteliBUS Manager V3.40_B-571848 allows remote unauthenticated users to execute arbitrary code CVE-2019-95704.8An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI, related to the site_CVE-2019-95727.2SchoolCMS version 2.3.1 allows file upload via the theme upload feature at admin.php?m=admin&c=theme&a=upload by using the .zip extension al CVE-2019-95737.5The WP Human Resource Management plugin before 2.2.6 for WordPress mishandles leave applications.CVE-2019-95747.5The WP Human Resource Management plugin before 2.2.6 for WordPress does not ensure that a leave modification occurs in the context of the Ad CVE-2019-95756.1The Quiz And Survey Master plugin 6.0.4 for WordPress allows wp-admin/admin.php?page=mlw_quiz_results quiz_id XSS.CVE-2019-95766.1The Blog2Social plugin before 5.0.3 for WordPress allows wp-admin/admin.php?page=blog2social-ship XSS.CVE-2019-95787.5In devs.c in Yubico libu2f-host before 1.1.8, the response to init is misparsed, leaking uninitialized stack memory back to the device.CVE-2019-95798.1An issue was discovered in Illumos in Nexenta NexentaStor 4.0.5 and 5.1.2, and other products. The SMB server allows an attacker to have uni CVE-2019-95806.1In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3, it is possible to bypass the CORS protection mechanism via a "null" or CVE-2019-95818.8phpscheduleit Booked Scheduler 2.7.5 allows arbitrary file upload via the Favicon field, leading to execution of arbitrary Web/custom-favico