EUVD-2026-65316
GHSA-5mm9-h6w4-7v8m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Reflected XSS requires the victim to follow a crafted link (UI:R); scope changes because attacker script executes in the victim's browser context (S:C), not on the web server.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only triggerable on pages hosting a Forminator form configured to use the Stripe Checkout Sessions payment API, which became the default in 1.56.0.
AnalysisAI
DOM-based reflected XSS in the Forminator Forms WordPress plugin (all versions up to and including 1.57.0) allows unauthenticated network attackers to execute arbitrary JavaScript in victim browsers by embedding a payload in the 'error_description' URL parameter, which the plugin's front.stripe.js writes to the DOM without sanitization. The attack surface expanded significantly when Stripe Checkout Sessions became the plugin's default payment method in version 1.56.0, meaning any site that upgraded to 1.56.0 or 1.57.0 without changing payment settings is exposed on pages hosting a Forminator form. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must both be met for exploitation: the target WordPress site must have Forminator Forms version 1.56.0 through 1.57.0 installed, and the specific page the victim visits must host a Forminator form configured to use the Stripe Checkout Sessions payment API. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector scores 7.2 using UI:N, which is atypical for reflected XSS - victims must generally navigate to a crafted URL, placing this firmly in UI:R territory (which would yield 6.1). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Forminator Forms to version 1.57.0.1 or later; the fix is documented in the WordPress plugin repository changeset at plugins.trac.wordpress.org/changeset comparing the 1.57.0 and 1.57.0.1 tags, and the full Wordfence disclosure is available at wordfence.com/threat-intel/vulnerabilities/id/a669f05d-67c7-45ac-ae56-e7c637ece880. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, update the Forminator Forms plugin to version 1.57.0.1 or later through the WordPress dashboard or automated updates. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated arbitrary file upload leading to remote code execution affects the Forminator Forms WordPress plugin (WP
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.2) allows unauthentica
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthentic
Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject ar
Unauthenticated enumeration of sequential draft entry IDs in the Forminator Forms WordPress plugin (all versions up to a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today