Critical Forminator plugin flaw impacts over 300k WordPress sites

Forminator, a widely used WordPress plugin, contains multiple security flaws including a critical unrestricted file upload vulnerability (CVE-2024-28890, CVSS 9.8), an SQL injection (CVE-2024-31077), and an XSS (CVE-2024-31857); site administrators are urged to upgrade to Forminator 1.29.3 to remediate these issues, as approximately 320,000 sites may still be vulnerable despite no public exploitation reports to date.