Forminator CVE-2026-116858

Requires a low-privileged authenticated account on the target WordPress site (CVSS PR:L) with access to a Forminator feature that accepts input, into which script-related HTML tags are injected because the plugin improperly neutralizes them (CWE-80); affected versions are those up to and including Forminator 1.58.3. The specific form field, endpoint, or configuration that triggers the flaw is not described in the available sources. Exploitation is limited by the authentication requirement and, for typical Basic XSS, by the need for a victim to subsequently render the injected content - meaning impact depends on another user or administrator viewing the stored payload.

This is a genuinely low-to-moderate priority issue, not a high-severity emergency. The input CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) yields a base score of 4.3 (Medium), and the only impact flagged is a low confidentiality effect - consistent with a Basic XSS/content-injection flaw rather than system compromise. The vector's PR:L indicates authentication is required, so this is not an unauthenticated attack. The vuln.today decision label is 'this_month' (routine remediation), not act_now or emergency. No CISA KEV listing is present (so exploitation is NOT confirmed in the wild) and no EPSS probability was supplied, so widespread automated exploitation cannot be quantified from this data. The sole reference is a Patchstack vulnerability-database advisory, which is a report rather than verified working exploit code. One notable inconsistency: the supplied vector sets UI:N and S:U, yet XSS/code-injection flaws typically require a victim to render the payload (UI:R) and cross a scope boundary into the victim's browser (S:C) - this mismatch suggests the input scoring may understate the interaction/scope mechanics, and the precise trigger is not described in the available sources. Overall: a real but bounded, authentication-gated client-side injection issue that merits scheduled patching, not crisis response.

A low-privileged authenticated user submits or configures a Forminator form field containing script-related HTML tags that the plugin fails to neutralize; the stored content later executes as script in another user's or administrator's browser session when the data is rendered. No verified working exploit code was provided - only a Patchstack advisory reference - and the exact injection point is not described in the available sources. Because PR:L applies, the attacker needs at least minimal authenticated access to the WordPress instance.