Forminator CVE-2026-102388

Exploitation requires an attacker to reach a Forminator input that is stored and later rendered without output encoding (e.g., a form submission field), and a victim - typically an administrator reviewing submissions in wp-admin - to view that stored content (UI:R). This limits impact to environments running Forminator at or below 1.57.3 where submissions are reviewed in-browser; it does not grant direct server compromise. The CVSS PR:N implies the injecting user needs no account, consistent with a public form submission, but defenders should confirm whether the vulnerable field is a public form or an authenticated/admin field, as that materially changes who can trigger it.

This is a moderate-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1) describes a network-reachable, low-complexity stored XSS requiring no attacker privileges but requiring victim interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in a different security context (the victim's authenticated browser session). All three impact metrics are Low, consistent with script execution rather than full system compromise. Exploitation signals are weak: no EPSS score, KEV status, or public exploit is present in the supplied data, so this is 'no public exploit identified at time of analysis.' The PR:N rating is the main point to verify - many WordPress stored-XSS flaws require at least contributor-level authentication, but for a form-builder plugin the injection vector is plausibly an unauthenticated public form submission, which would justify PR:N; confirm whether the injection point is a public form or an authenticated admin field with the vendor/Patchstack advisory. Net: a genuine stored XSS worth patching on a widely used plugin, but not an emergency absent evidence of active exploitation.

An attacker submits a Forminator form (or supplies form data) containing a malicious JavaScript payload that the plugin stores without proper neutralization. When an administrator later views the stored submission in the WordPress dashboard, the script executes in their authenticated session, enabling session/cookie theft or admin actions on their behalf. No public proof-of-concept is identified in the provided data.