EUVD-2026-67405
GHSA-j6r2-54rm-cr23
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSubmit crafted rich-text payload via public form
-
DeliveryBypass unsanitized input processing in textarea.php
-
ExploitMalicious script stored in WordPress database
-
ExecutionAdministrator or visitor loads form entries page
-
PersistInjected script executes in victim browser context
-
ImpactSteal session token or perform actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that at least one Textarea field within a published Forminator form has the Rich-Text editor option explicitly enabled - this is a non-default, administrator-configured setting, and forms using standard plain-text textarea fields are not affected. No authentication is required from the attacker to submit the malicious form entry (CVSS PR:N confirmed). Successful script execution is gated on a victim - typically an administrator reviewing entries - loading a page or admin view that renders the stored malicious content; the attacker cannot force this action directly. Exploitation is limited to WordPress installations running plugin versions 1.57.0.1 or earlier. Sites on version 1.57.0.2 or later are not affected. |
| Impact | The CVSS 7.2 score reflects a network-accessible, no-privileges-required, scope-changing vulnerability - signals that typically indicate high urgency. However, a critical moderating factor is that exploitation requires the Rich-Text editor option to be explicitly enabled on the target Textarea field, which is not a default configuration; sites that have never enabled this option are not exposed. No EPSS data was provided in the input, and no CISA KEV listing exists, indicating no confirmed widespread exploitation. The absence of a known public POC further tempers urgency beyond the CVSS headline. The provided CVSS vector assigns UI:N, but stored XSS inherently requires a victim to load the affected page - this metric assignment is inconsistent with standard CVSS 3.1 guidance for stored XSS and may overstate exploitability score. Practically, the impact is most significant when form entries are reviewed by authenticated administrators, enabling session hijacking or privilege escalation within the WordPress dashboard. Organizations running Forminator Forms with Rich-Text Textarea fields enabled should treat patching as high priority within normal patch cycles rather than emergency response. |
| Exploit ScenarioDerived | An unauthenticated attacker identifies a WordPress site running Forminator Forms with a contact or inquiry form containing a Rich-Text Textarea field with the rich-text editor enabled. The attacker submits the form with a crafted payload - such as an image onerror handler or script tag embedded in the rich-text content - which is stored in the WordPress database without sanitization. When a site administrator later reviews form submissions in the WordPress backend, the stored script executes in the administrator's browser, potentially stealing session cookies, capturing credentials, or creating a rogue admin account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 28, 2026
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthenticated attackers to inject persistent malicious scripts via Rich-Text Textarea fields, which execute in any visitor's or administrator's browser upon page access. The flaw originates from insufficient input sanitization at submission time and missing output escaping at render time, with vulnerable code paths confirmed across multiple plugin files including textarea.php, abstract-class-front-action.php, and admin-page-entries.php. A patched release (1.57.0.2) is confirmed available via the WordPress plugin repository changeset; no public exploit code or CISA KEV listing has been identified at time of analysis.
RemediationAI
The primary fix is to update the Forminator Forms plugin to version 1.57.0.2 or later, confirmed as the patched release via the WordPress plugin repository changeset (https://plugins.trac.wordpress.org/changeset?old_path=%2Fforminator/tags/1.57.0.1&new_path=%2Fforminator/tags/1.57.0.2). Updates can be applied through the WordPress admin dashboard under Plugins > Installed Plugins or via WP-CLI. As a compensating control for sites unable to patch immediately, administrators should disable the Rich-Text editor option on all Textarea fields in Forminator forms - this directly eliminates the exploitation vector but reduces form functionality for users who rely on formatted text input. After patching, administrators should review and sanitize existing stored form entries that may contain injected payloads, as the patch corrects future output escaping but does not automatically cleanse historical stored content. Restricting access to form entry admin pages to the minimum necessary administrator accounts also limits the blast radius of any successful stored XSS execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) manifesting as stored XSS in the WPMU Dev Forminator Forms plugin (CPE: cpe:2.3:a:wpmudev:forminator_forms_-_contact_form,_payment_form_&_custom_form_builder:*:*:*:*:*:*:*:*). When a Textarea field is configured with the Rich-Text editor option, the plugin invokes a WYSIWYG editor (shared-ui.min.js) that permits HTML markup input. The plugin fails to sanitize this markup server-side before storage (exploited path: library/fields/textarea.php line 411, library/abstracts/abstract-class-front-action.php line 127) and fails to escape the stored content on output in both admin entry views (library/modules/custom-forms/admin/admin-page-entries.php line 338, admin/views/custom-form/entries/content-details.php line 211). This dual failure - missing input sanitization and missing output escaping - is the canonical stored XSS pattern. The scope-changed CVSS metric (S:C) reflects that the injected script executes in victims' browser contexts rather than the server context.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
UI:R applied because stored XSS requires a victim to load the affected page; all other metrics align with the reported vector.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted Textarea field has the Rich-Text editor option enabled.
Executive ViewAI
Forminator Forms WordPress plugin (versions through 1.57.0.1) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject persistent malicious scripts executable by all website visitors and administrators. Organizations using this plugin for customer-facing forms face direct risk of malware delivery, credential theft, session hijacking, and website defacement affecting customers and staff. Immediate patching to version 1.57.0.2 is critical to eliminate the attack vector.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Exploit-DB