EUVD-2026-53704
GHSA-9m8m-xgrc-pfc4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Injection requires no auth (PR:N, AV:N, AC:L); UI:R applied because stored XSS payload impact materializes only when a victim navigates to the injected page; S:C retained for cross-boundary browser execution.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is possible because Forminator_Core::sanitize_array() skips all filtering for keys prefixed with 'select-', and set_field_data() treats a submitted 'return' member as a trusted internal flag - allowing an unauthenticated attacker to forge and persist a complete upload field record with an arbitrary file_url value without any sanitization or validation.
AnalysisAI
Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject arbitrary JavaScript into pages by exploiting two compounding logic flaws: sanitize_array() silently skips all filtering for keys prefixed with 'select-', and set_field_data() treats a user-supplied 'return' member as a trusted internal flag, allowing a forged upload record with a malicious file_url to be persisted in the database. Because the payload is stored rather than reflected, a single unauthenticated HTTP request creates a persistent script that executes in every subsequent visitor's browser on the affected page. No public exploit code or CISA KEV listing is confirmed at time of analysis, though Wordfence's disclosure provides sufficient technical specificity to reconstruct the attack.
Technical ContextAI
The vulnerable component is the Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress developed by WPMUDEV (CPE: cpe:2.3:a:wpmudev:forminator_forms_-_contact_form,_payment_form_&_custom_form_builder:*:*:*:*:*:*:*:*). Two distinct code paths in the plugin combine to produce the flaw. First, Forminator_Core::sanitize_array() (class-core.php:L616) contains a logic bypass that unconditionally skips all input filtering for any submitted key whose name begins with the literal prefix 'select-'. Second, set_field_data() (class-form-entry-model.php:L1569) treats a submitted 'return' member inside that key's data structure as a trusted internal control flag - a server-side state indicator that was never intended to arrive from user input - and persists the entire fabricated upload field record, including an attacker-controlled file_url, directly to the database without sanitization or validation. The stored value is later rendered to page visitors without output escaping, satisfying CWE-79 (Improper Neutralization of Input During Web Page Generation). Vulnerable source code is confirmed present in both the 1.55.1 and 1.56.0 plugin tags in the WordPress SVN repository, at front-action.php:L1091 and abstract-class-front-action.php:L127 for the form processing path.
RemediationAI
Update the Forminator Forms plugin to the first version above 1.56.1 that incorporates the trunk fix once it is released as a tagged version - a remediation changeset has been committed to the plugin's SVN trunk (https://plugins.trac.wordpress.org/changeset?reponame=&new=3628716%40forminator%2Ftrunk&old=3628530%40forminator%2Ftrunk), but an exact released patched version number is not independently confirmed from available data; monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/fd9a81eb-2211-42e9-a456-fb60f3ca2c0f for patch release confirmation. Until a patched release is available, apply the following compensating controls in order of preference: (1) Disable or unpublish any Forminator forms that include select fields or file upload fields to eliminate the attack surface, at the cost of removing that form functionality from public use. (2) Deploy a WAF rule to inspect and block form submission POST requests containing any key matching the pattern 'select-*' alongside a nested 'return' key - this may produce false positives on legitimate multi-select field submissions and should be tested against your form configurations before production deployment. (3) Restrict access to WordPress form submission endpoints (wp-admin/admin-ajax.php and REST form endpoints) to authenticated sessions where the business use case permits, though this fundamentally changes the public-facing nature of the forms.
Unauthenticated arbitrary file upload leading to remote code execution affects the Forminator Forms WordPress plugin (WP
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.2) allows unauthentica
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthentic
DOM-based reflected XSS in the Forminator Forms WordPress plugin (all versions up to and including 1.57.0) allows unauth
Unauthenticated enumeration of sequential draft entry IDs in the Forminator Forms WordPress plugin (all versions up to a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today