# Forminator Forms – Contact Form, Payment Form & Custom Form Builder

> Best WordPress form builder plugin. Create contact forms, payment forms & order forms with 1000+ integrations.

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 04:20 UTC.

## Facts (WordPress.org)

- Slug: `forminator`
- Author: WPMU DEV - Your All-in-One WordPress Platform
- Version: 1.58.4
- Active installs: 600,000+
- Last update: 2026-11-02 (4 days ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.4, PHP 7.4
- Tags: contact form, custom form, forms, payment form, WordPress form plugin
- Page: https://wordpress.org/plugins/forminator/

## Checks (against WordPress 7.1.4)

- OK: Updated 4 days ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Leaky ↔ Spam-proof, Breaking ↔ Smooth, Slows pages ↔ Speeds up, Inaccessible ↔ Accessible, Slow ↔ Responsive, Locked in ↔ Portable.

## Known vulnerabilities

- 2026-11-03 MEDIUM: Authenticated (Subscriber+) Arbitrary Shortcode Injection (up to 1.58.3). CVE-2026-116858, https://www.wordfence.com/threat-intel/vulnerabilities/id/48dfb893-a2a6-4425-b710-db31a41333fd?source=api-prod
- 2026-11-03 MEDIUM: Missing Authorization (up to 1.58.3). CVE-2026-116859, https://www.wordfence.com/threat-intel/vulnerabilities/id/8f4d38f7-b2a1-4772-b9e3-250fedce2f2a?source=api-prod
- 2026-10-30 MEDIUM: Unauthenticated Limited File Deletion via Draft Upload Metadata (up to 1.55.0.2). CVE-2026-5461, https://www.wordfence.com/threat-intel/vulnerabilities/id/de1aaacf-8fe1-4a1e-9846-f78cc469ec20?source=api-prod
- 2026-10-30 HIGH: Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter (up to 1.57.3.1). CVE-2026-97638, https://www.wordfence.com/threat-intel/vulnerabilities/id/61d065d0-d61e-4e65-99ae-eded211681ac?source=api-prod
- 2026-10-16 MEDIUM: Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags (up to 1.58.1). CVE-2026-101335, https://www.wordfence.com/threat-intel/vulnerabilities/id/27640d44-1474-416a-8efd-e9524f9d3c7f?source=api-prod
- 2026-10-16 MEDIUM: Unauthenticated Arbitrary Shortcode Execution via 's' Search Parameter and Anonymous Comment via render_block (up to 1.58.1). CVE-2026-103911, https://www.wordfence.com/threat-intel/vulnerabilities/id/9d922a8f-611f-4586-b8ba-72d18d11a975?source=api-prod
- 2026-10-12 MEDIUM: Missing Authorization (up to 1.58.0). CVE-2026-108486, https://www.wordfence.com/threat-intel/vulnerabilities/id/a4b18a09-408d-4b67-b44c-5a3a814f2f55?source=api-prod
- 2026-10-10 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 1.57.3). CVE-2026-102388, https://www.wordfence.com/threat-intel/vulnerabilities/id/40a40525-f9d3-45d1-8b40-05131d11c936?source=api-prod
- 2026-10-10 HIGH: Unauthenticated Privilege Escalation (up to 1.57.3). CVE-2026-96341, https://www.wordfence.com/threat-intel/vulnerabilities/id/308aac91-daac-4bb7-a330-cc2ca2bedb43?source=api-prod
- 2026-10-10 MEDIUM: Missing Authorization (up to 1.57.3). CVE-2026-65459, https://www.wordfence.com/threat-intel/vulnerabilities/id/48db0c79-8570-4bb6-b1ae-210a22f2f705?source=api-prod
- 2026-10-09 MEDIUM: Unauthenticated Payment Bypass (up to 1.57.2). CVE-2026-96336, https://www.wordfence.com/threat-intel/vulnerabilities/id/611b08ee-ffa4-46c2-8d15-06ed949a448c?source=api-prod
- 2026-10-08 MEDIUM: Cross-Site Request Forgery (up to 1.57.3). CVE-2026-106611, https://www.wordfence.com/threat-intel/vulnerabilities/id/89246ce6-4d8d-4489-a6e1-cecb0a40e791?source=api-prod
- 2026-10-07 MEDIUM: Missing Authorization (up to 1.57.2). CVE-2026-96335, https://www.wordfence.com/threat-intel/vulnerabilities/id/083b9005-4daf-4562-86cf-d126a6bd1e62?source=api-prod
- 2026-10-01 HIGH: Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field (up to 1.57.2). CVE-2026-85235, https://www.wordfence.com/threat-intel/vulnerabilities/id/2ff3d390-ad00-4233-ab25-f1afb679300e?source=api-prod
- 2026-10-01 HIGH: Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter (up to 1.57.2). CVE-2026-92144, https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f320d2-fd24-47b5-804d-31e3afdc31ba?source=api-prod
- 2026-09-23 MEDIUM: Missing Authorization (up to 1.57.2.0). CVE-2026-87069, https://www.wordfence.com/threat-intel/vulnerabilities/id/5e8a16ea-2a0e-43be-8ca3-066bcb457866?source=api-prod
- 2026-09-23 MEDIUM: Missing Authorization (up to 1.57.2.0). CVE-2026-87074, https://www.wordfence.com/threat-intel/vulnerabilities/id/c7bb018b-2b7e-4fe4-b8f1-8284d2084d13?source=api-prod
- 2026-09-23 MEDIUM: Unauthenticated Poll Vote Limit Bypass (up to 1.57.2.0). CVE-2026-87070, https://www.wordfence.com/threat-intel/vulnerabilities/id/0a023692-18f6-4863-8802-d613f6ddf083?source=api-prod
- 2026-09-23 MEDIUM: Missing Authorization to Unauthenticated Arbitrary Post Meta Injection (up to 1.57.2.0). CVE-2026-87071, https://www.wordfence.com/threat-intel/vulnerabilities/id/7b869c65-5d2c-45d6-b873-0676643af394?source=api-prod
- 2026-09-20 MEDIUM: Authenticated (Admin+) PHP Object Injection (up to 1.57.2.0). CVE-2026-87067, https://www.wordfence.com/threat-intel/vulnerabilities/id/74f53eb4-299f-438a-8eb5-bf1ede31a915?source=api-prod
- 2026-09-20 HIGH: Authenticated (Admin+) Privilege Escalation (up to 1.57.2.0). CVE-2026-87068, https://www.wordfence.com/threat-intel/vulnerabilities/id/4ed64493-e41a-4369-a1b1-2d3425941d9e?source=api-prod
- 2026-09-19 CRITICAL: Unauthenticated Arbitrary Shortcode Execution via 'current_url' Parameter (up to 1.57.2). CVE-2026-92229, https://www.wordfence.com/threat-intel/vulnerabilities/id/7c28869c-c880-4322-9f17-09495a08576e?source=api-prod
- 2026-08-28 MEDIUM: Unauthenticated Payment Bypass (up to 1.57.1). CVE-2026-82220, https://www.wordfence.com/threat-intel/vulnerabilities/id/906e73a2-c05c-4a5e-b111-df3c1b05f8a5?source=api-prod
- 2026-08-28 HIGH: Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field (up to 1.57.0.1). CVE-2026-18324, https://www.wordfence.com/threat-intel/vulnerabilities/id/5f8a0704-1c06-4342-b05a-7bd815a87833?source=api-prod
- 2026-08-26 HIGH: Unauthenticated Privilege Escalation (before 1.57.1). CVE-2026-19220, https://www.wordfence.com/threat-intel/vulnerabilities/id/1e4fdc0f-585a-488e-8df9-9bbd1dca824f?source=api-prod
- 2026-08-25 HIGH: Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) (up to 1.57.0.2). CVE-2026-18323, https://www.wordfence.com/threat-intel/vulnerabilities/id/85b02779-d85f-4700-9994-68391e69c1ea?source=api-prod
- 2026-08-25 HIGH: Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter (up to 1.57.0). CVE-2026-18328, https://www.wordfence.com/threat-intel/vulnerabilities/id/a669f05d-67c7-45ac-ae56-e7c637ece880?source=api-prod
- 2026-08-22 HIGH: Authenticated (Administrator+) Remote Code Execution (before 1.57.0.5). CVE-2026-19221, https://www.wordfence.com/threat-intel/vulnerabilities/id/fcae7cb5-d333-4bde-a43b-ea3ef3b023fa?source=api-prod
- 2026-08-22 MEDIUM: Authenticated (Custom Role+) Privilege Escalation (before 1.57.0.7). CVE-2026-19222, https://www.wordfence.com/threat-intel/vulnerabilities/id/1ee5868f-7240-45ca-9f8a-b1489b2cc21c?source=api-prod
- 2026-08-20 HIGH: Unauthenticated PHP Object Injection (up to 1.57.0). CVE-2026-66583, https://www.wordfence.com/threat-intel/vulnerabilities/id/21bc466b-dc2e-468d-b793-6659913e4664?source=api-prod
- 2026-08-18 CRITICAL: Unauthenticated Arbitrary File Upload via Forged Upload Field Configuration (up to 1.56.1). CVE-2026-15748, https://www.wordfence.com/threat-intel/vulnerabilities/id/263ac05d-f1ca-46e3-a43e-3b45eb8066d4?source=api-prod
- 2026-08-16 MEDIUM: Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter (up to 1.55.0.2). CVE-2026-12998, https://www.wordfence.com/threat-intel/vulnerabilities/id/36aa7193-0e31-4084-97d0-8c22ebff3f05?source=api-prod
- 2026-08-06 HIGH: Authenticated (Contributor+) Privilege Escalation (up to 1.56.0). CVE-2026-28111, https://www.wordfence.com/threat-intel/vulnerabilities/id/d598e3c7-54ef-4650-abf9-70cb66713d08?source=api-prod
- 2026-08-06 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 1.56.0). CVE-2026-28143, https://www.wordfence.com/threat-intel/vulnerabilities/id/3cbf77f4-59f5-49cd-ba2b-dc9de3d031b6?source=api-prod
- 2026-08-06 HIGH: Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field (up to 1.56.1). CVE-2026-18325, https://www.wordfence.com/threat-intel/vulnerabilities/id/fd9a81eb-2211-42e9-a456-fb60f3ca2c0f?source=api-prod
- 2026-07-13 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 1.55.0.1). CVE-2026-57814, https://www.wordfence.com/threat-intel/vulnerabilities/id/c5697616-4e19-45a3-b860-623af66469bc?source=api-prod
- 2026-07-13 HIGH: Unauthenticated Arbitrary File Download (up to 1.55.0.2). CVE-2026-57815, https://www.wordfence.com/threat-intel/vulnerabilities/id/355d6e61-a45b-4682-bfad-77df18ae79f4?source=api-prod
- 2026-06-25 HIGH: Unauthenticated Stored Cross-Site Scripting (up to 1.53.1). CVE-2026-56071, https://www.wordfence.com/threat-intel/vulnerabilities/id/504aff5b-5951-4d07-9ff0-e6f7cfe5dc32?source=api-prod
- 2026-05-07 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter (up to 1.51.1). CVE-2026-6222, https://www.wordfence.com/threat-intel/vulnerabilities/id/e860aa70-b8ef-4b2a-a035-b01efce30a79?source=api-prod
- 2026-05-07 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook (up to 1.53.0). CVE-2026-6214, https://www.wordfence.com/threat-intel/vulnerabilities/id/d7b8d42c-bceb-456e-a682-358e8df831e3?source=api-prod
- 2026-05-05 MEDIUM: Missing Authorization to Unauthenticated Stripe PaymentIntent Reuse / Underpayment Bypass via 'paymentid' Parameter (up to 1.52.0). CVE-2026-2729, https://www.wordfence.com/threat-intel/vulnerabilities/id/1afb94ab-b3ba-4598-8ff4-f9ffc6717371?source=api-prod
- 2026-05-05 HIGH: Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]' (up to 1.52.1). CVE-2026-5192, https://www.wordfence.com/threat-intel/vulnerabilities/id/788422c4-e070-48aa-a85d-a5d5a25a6a1d?source=api-prod
- 2026-02-22 MEDIUM: Missing Authorization (up to 1.50.2). CVE-2026-32409, https://www.wordfence.com/threat-intel/vulnerabilities/id/2283b147-b904-4086-8cb1-6d8969ccbaf6?source=api-prod
- 2026-02-16 MEDIUM: Authenticated (Administrator+) Stored Cross-Site Scripting (up to 1.50.2). CVE-2026-2002, https://www.wordfence.com/threat-intel/vulnerabilities/id/4ada2055-3c4a-4b6f-8803-2eac8ede5ec7?source=api-prod
- 2026-01-08 MEDIUM: Missing Authorization to Authenticated (Forminator User+) CSV Export (up to 1.49.1). CVE-2025-14782, https://www.wordfence.com/threat-intel/vulnerabilities/id/2b28ddeb-44f5-4d19-b866-94fc2088ee6d?source=api-prod
- 2025-07-17 MEDIUM: Authenticated (Administrator+) SQL Injection via `order_by` Parameter (up to 1.45.0). CVE-2025-7638, https://www.wordfence.com/threat-intel/vulnerabilities/id/5f5a1eb3-3fda-49de-aefb-2205c9ca3520?source=api-prod
- 2025-07-01 HIGH: Unauthenticated PHP Object Injection (PHAR) Triggered via Administrator Form Submission Deletion (up to 1.44.2). CVE-2025-6464, https://www.wordfence.com/threat-intel/vulnerabilities/id/6707aa4c-c652-42c0-bdb9-00be984e7271?source=api-prod
- 2025-07-01 HIGH: Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission Deletion (up to 1.44.2). CVE-2025-6463, https://www.wordfence.com/threat-intel/vulnerabilities/id/6dc9b4cb-d36b-4693-a7b9-1dad123b6639?source=api-prod
- 2025-06-04 MEDIUM: Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters (up to 1.44.1). CVE-2025-5341, https://www.wordfence.com/threat-intel/vulnerabilities/id/415bfddb-5223-439f-8a08-535f79631ff0?source=api-prod
- 2025-04-16 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via 'limit' (up to 1.42.0). CVE-2025-3487, https://www.wordfence.com/threat-intel/vulnerabilities/id/5039d63b-377d-435a-be31-4ae81ea30dd3?source=api-prod
- 2025-04-16 MEDIUM: Order Replay Vulnerability (up to 1.42.0). CVE-2025-3479, https://www.wordfence.com/threat-intel/vulnerabilities/id/c873c04e-516e-41ee-a295-b8c5235abc1b?source=api-prod
- 2025-02-26 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting (1.39.2 to 1.39.2). CVE-2025-0469, https://www.wordfence.com/threat-intel/vulnerabilities/id/14043276-ba0a-4862-a1a7-00b4c372c5bc?source=api-prod
- 2025-01-30 MEDIUM: Reflected Cross-Site Scripting via Title Parameter (up to 1.38.2). CVE-2025-0470, https://www.wordfence.com/threat-intel/vulnerabilities/id/f5281d4b-c2cd-4972-b837-e101a8893c6e?source=api-prod
- 2025-01-24 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 1.38.2). CVE-2024-7052, https://www.wordfence.com/threat-intel/vulnerabilities/id/286df83a-d723-4443-b265-f91cf5abb385?source=api-prod
- 2024-10-30 MEDIUM: Insecure Direct Object Reference to Submission Manipulation (up to 1.36.0). CVE-2024-9700, https://www.wordfence.com/threat-intel/vulnerabilities/id/fbed35ca-1630-46a4-8b1f-60cc7216f294?source=api-prod
- 2024-10-25 HIGH: Missing Authorization to Authenticated (Contributor+) Form Update and Creation (up to 1.35.1). CVE-2024-10402, https://www.wordfence.com/threat-intel/vulnerabilities/id/be1d9d2b-cbdf-4d62-85fe-2616eaf02848?source=api-prod
- 2024-10-16 MEDIUM: Cross-Site Request Forgery to Draft Custom Form Creation (up to 1.35.1). CVE-2024-9352, https://www.wordfence.com/threat-intel/vulnerabilities/id/81e6e266-078a-4f4f-a335-c9d388f41ef2?source=api-prod
- 2024-10-16 MEDIUM: Cross-Site Request Forgery to Draft Quiz Creation (up to 1.35.1). CVE-2024-9351, https://www.wordfence.com/threat-intel/vulnerabilities/id/8d89e3b7-d980-42bb-ab0c-d86ab174a69c?source=api-prod
- 2024-09-09 MEDIUM: Reflected Cross-Site Scripting (up to 1.34.0). CVE-2024-45625, https://www.wordfence.com/threat-intel/vulnerabilities/id/64e14944-db83-413f-82a3-cda594398c7e?source=api-prod
- 2024-08-01 HIGH: HubSpot Developer API Key Sensitive Information Exposure (up to 1.29.1). CVE-2024-7389, https://www.wordfence.com/threat-intel/vulnerabilities/id/0d04b822-a48a-485e-b9b5-f5a213307c71?source=api-prod
- 2024-04-18 CRITICAL: Authenticated (Admin+) SQL Injection (up to 1.29.2). CVE-2024-31077, https://www.wordfence.com/threat-intel/vulnerabilities/id/224233bc-68f3-40e4-8182-4831ccce93fb?source=api-prod
- 2024-04-18 MEDIUM: Reflected Cross-Site Scripting (up to 1.15.2). CVE-2024-31857, https://www.wordfence.com/threat-intel/vulnerabilities/id/97cbf2d7-2fdc-4c10-872d-add54687dd9b?source=api-prod
- 2024-04-18 CRITICAL: Unauthenticated Arbitrary File Upload (up to 1.28.1). CVE-2024-28890, https://www.wordfence.com/threat-intel/vulnerabilities/id/f58d5464-b12d-4d01-985a-68854b0b2fdd?source=api-prod
- 2024-04-08 MEDIUM: Authenticated (Contributor+) Stored Cross-Site Scripting via forminator_form Shortcode (up to 1.29.2). CVE-2024-3053, https://www.wordfence.com/threat-intel/vulnerabilities/id/19439622-6396-4f10-ab71-aa243b6812fa?source=api-prod
- 2024-03-29 HIGH: Unauthenticated Stored Cross-Site Scripting via File Upload (up to 1.29.0). CVE-2024-1794, https://www.wordfence.com/threat-intel/vulnerabilities/id/23feb72c-7e6f-436b-b56e-dc6185302d31?source=api-prod
- 2024-03-25 MEDIUM: Reflected Cross-Site Scripting (up to 1.29.0). CVE-2024-29777, https://www.wordfence.com/threat-intel/vulnerabilities/id/1a6fbb60-811a-4763-b301-694bc8d387e7?source=api-prod
- 2023-11-14 MEDIUM: Authenticated (Administrator+) Arbitrary File Upload (up to 1.27.0). CVE-2023-6133, https://www.wordfence.com/threat-intel/vulnerabilities/id/13cfa202-ab90-46c0-ab53-00995bfdcaa3?source=api-prod
- 2023-10-27 MEDIUM: Authenticated (Admin+) Stored Cross-Site Scripting (up to 1.26.0). CVE-2023-5119, https://www.wordfence.com/threat-intel/vulnerabilities/id/6f34b94f-ea72-4a42-abea-2f2eb565ffdd?source=api-prod
- 2023-08-29 CRITICAL: Unauthenticated Arbitrary File Upload (up to 1.24.6). CVE-2023-4596, https://www.wordfence.com/threat-intel/vulnerabilities/id/9cd87da6-1f4c-4a15-8ebb-6e0f8ef72513?source=api-prod
- 2023-07-10 MEDIUM: Reflected Cross-Site Scripting (up to 1.24.1). CVE-2023-3134, https://www.wordfence.com/threat-intel/vulnerabilities/id/00272fe2-52aa-4183-8b57-6b51ad57c657?source=api-prod
- 2023-06-12 MEDIUM: Race Condition to Multiple Poll Voting (up to 1.23.3). CVE-2023-2010, https://www.wordfence.com/threat-intel/vulnerabilities/id/a40cb2da-dc13-4e20-9602-a4e6c2eade43?source=api-prod
- 2023-04-12 MEDIUM: Missing Authorization on 'load_hcaptcha_preview' AJAX function (up to 1.22.1). WF-2ef15cb1-b320-42d9-a2fd-afff2ec8a93b, https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef15cb1-b320-42d9-a2fd-afff2ec8a93b?source=api-prod
- 2023-04-12 MEDIUM: Missing Authorization on 'load_recaptcha_preview' AJAX function (up to 1.22.1). WF-718e54f5-f040-42d6-958d-255d905615d5, https://www.wordfence.com/threat-intel/vulnerabilities/id/718e54f5-f040-42d6-958d-255d905615d5?source=api-prod
- 2023-04-12 MEDIUM: Missing Authorization on 'hubspot_support_request' AJAX function (up to 1.22.1). WF-d0cb4434-94c5-42a9-bd86-869058dcbf67, https://www.wordfence.com/threat-intel/vulnerabilities/id/d0cb4434-94c5-42a9-bd86-869058dcbf67?source=api-prod
- 2021-10-20 MEDIUM: Admin+ Stored Cross-Site Scripting (before 1.15.4). CVE-2021-24700, https://www.wordfence.com/threat-intel/vulnerabilities/id/9d68ab8b-38c8-47aa-8b69-8cebe0a8d24e?source=api-prod
- 2021-07-14 HIGH: Unauthenticated Stored Cross-Site Scripting (before 1.14.12). CVE-2021-36821, https://www.wordfence.com/threat-intel/vulnerabilities/id/e558100a-5866-4e7f-bae7-47a1f492ab27?source=api-prod
- 2021-03-01 MEDIUM: Cross-Site Request Forgery Bypass (before 1.13.5). CVE-2021-4417, https://www.wordfence.com/threat-intel/vulnerabilities/id/cdee0cd8-b83b-4436-aebe-533f5af03ef1?source=api-prod
- 2019-02-06 MEDIUM: Cross-Site Scripting (before 1.6). CVE-2019-9567, https://www.wordfence.com/threat-intel/vulnerabilities/id/efe6c4aa-5e5d-4e3b-8a38-f85e163a9e00?source=api-prod
- 2019-02-06 MEDIUM: SQL Injection (before 1.6). CVE-2019-9568, https://www.wordfence.com/threat-intel/vulnerabilities/id/f88286b9-16b2-42a9-b8c6-0a6fe6c136ef?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=forminator · HTML: https://todaywp.com/plugins/forminator