Forminator Forms CVE-2026-18325

Exploitation requires that the target WordPress site has the Forminator Forms plugin installed, active, and at version 1.56.1 or earlier. At least one published form must contain a select field or file upload field and must be accessible to unauthenticated users - which is the standard deployment model for public contact and payment forms. No authentication, no administrative privileges, and no non-default plugin configuration are required; the vulnerable code paths are exercised during ordinary unauthenticated form submissions. The primary factor limiting exploitation scope is the requirement that the specific plugin be installed and that a publicly accessible form with the affected field type exist; WordPress sites not running Forminator Forms, or running it exclusively for authenticated-only forms, are not directly exploitable. The stored nature of the XSS extends impact to all subsequent page visitors, not just the attacker's own session, amplifying the effective blast radius beyond what attack complexity alone would suggest.

The CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) accurately reflects the elevated real-world risk: the attack is network-accessible, requires no authentication or elevated privileges, and carries a Changed scope (S:C) indicating impact escapes the plugin's own trust boundary into the victim's browser session. The UI:N assignment reflects that the attacker's injection step requires no victim interaction; a victim visiting the page is a subsequent, passive event. The S:C/C:L/I:L combination is consistent with classic XSS impact: theft of session cookies, credential harvesting, and injected content or redirection affecting all visitors. No EPSS score was provided in the available intelligence, preventing quantitative exploitation probability assessment. No CISA KEV listing is confirmed, and no standalone POC tool has been identified - however, the Wordfence advisory contains precise technical detail naming specific functions, line numbers, and parameter names, which substantially lowers the bar for independent exploit construction. The attack requires no special configuration beyond the plugin being installed and active with a publicly accessible form containing a select or upload field, which is the default intended use case. This is a genuine priority for any WordPress environment running Forminator Forms ≤1.56.1 - not a high-CVSS-but-low-real-risk case.

An unauthenticated attacker identifies a WordPress site running Forminator Forms ≤1.56.1 with a publicly accessible form containing a select field, then submits a single crafted HTTP POST request to the form's submission endpoint, embedding a 'select-' prefixed parameter with a nested 'return' flag and an arbitrary file_url containing a JavaScript payload. The plugin's sanitization bypass and forged-flag vulnerability cause this payload to be stored in the database as a trusted upload field record, and every subsequent visitor to the form-hosting page - including authenticated administrators - executes the script in their browser, enabling session token theft, account takeover, or malicious content injection. No standalone POC tool is publicly confirmed, but the Wordfence disclosure names precise function names, line numbers, and parameter semantics sufficient for exploit reconstruction.