EUVD-2026-65314
GHSA-mh72-7gfv-9x86
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Injection is unauthenticated (PR:N, AV:N, AC:L), but stored XSS execution requires an admin to load the submissions page (UI:R); scope changes because attacker context crosses into admin browser.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the Save-and-Continue draft submission AJAX endpoint is registered as nopriv, allowing unauthenticated attackers to bypass radio field option-membership validation and persist a crafted payload that, when rendered on the Submissions admin page, is auto-executed via the bundled Inputmask library's data-attribute callback binding.
AnalysisAI
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.2) allows unauthenticated attackers to inject persistent JavaScript payloads that auto-execute in the WordPress admin panel when an administrator views the Submissions page. The attack vector is the Save-and-Continue draft AJAX endpoint, which is registered without privilege checks (nopriv), bypassing radio field option-membership validation and permitting arbitrary values to be stored. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the targeted WordPress site has the Forminator Forms plugin installed and active at version 1.57.0.2 or earlier, and that at least one published form includes a Radio field type with the Save-and-Continue draft feature enabled - this is the specific configuration that exposes the vulnerable nopriv AJAX endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.2 is derived from a Scope:Changed vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Forminator Forms plugin to version 1.57.0.3 or later; this is the vendor-released patch confirmed by the WordPress SVN changeset (https://plugins.trac.wordpress.org/changeset?reponame=&new=3652727%40forminator%2Ftags%2F1.57.0.3&old=3652717%40forminator%2Ftags%2F1.57.0.2). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: disable Forminator Forms plugin on all WordPress installations running version 1.57.0.2 or earlier and document the action in change logs. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file upload leading to remote code execution affects the Forminator Forms WordPress plugin (WP
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthentic
Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject ar
DOM-based reflected XSS in the Forminator Forms WordPress plugin (all versions up to and including 1.57.0) allows unauth
Unauthenticated enumeration of sequential draft entry IDs in the Forminator Forms WordPress plugin (all versions up to a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today