Forminator Forms CVE-2026-18328

Two conditions must both be met for exploitation: the target WordPress site must have Forminator Forms version 1.56.0 through 1.57.0 installed, and the specific page the victim visits must host a Forminator form configured to use the Stripe Checkout Sessions payment API. The Stripe Checkout Sessions integration became the plugin default in version 1.56.0, so any installation upgraded to 1.56.0 or 1.57.0 without explicitly selecting a different payment method is automatically in scope. Beyond the server-side configuration requirement, the victim must be socially engineered into clicking a crafted URL - the attack cannot self-propagate or fire without that user navigation step. Sites running Forminator versions prior to 1.56.0, or those using Forminator solely for non-payment forms (contact, survey, etc.) without Stripe Checkout Sessions configured on any form, are not exposed to this vector. Authentication is not required by the attacker; however, the impact of a successful attack scales with the privilege level of the victim user (unauthenticated site visitors yield less value than authenticated administrators).

The provided CVSS 3.1 vector scores 7.2 using UI:N, which is atypical for reflected XSS - victims must generally navigate to a crafted URL, placing this firmly in UI:R territory (which would yield 6.1). This metric discrepancy warrants verification with Wordfence or NVD before using the published score for SLA prioritization. No EPSS score was provided in the input data, and the CVE carries no CISA KEV listing, indicating no confirmed active exploitation at time of analysis. Despite the absence of confirmed exploitation, the real-world exposure is broader than typical XSS findings: the Stripe Checkout Sessions feature became the default in version 1.56.0, meaning sites that updated without reviewing payment settings are automatically in scope - a configuration-by-default condition that expands the population of vulnerable deployments considerably. The Wordfence disclosure pinpoints four distinct vulnerable call sites in publicly browsable plugin source, lowering the barrier for independent exploit development. Even a mid-sized municipal IT team in sopot running WordPress for constituent payment services should treat this as an immediate patch priority, given the fix (1.57.0.1) is low-risk to deploy and the attack requires no server-side access or authentication. The S:C scope change in the CVSS vector correctly reflects that successful exploitation affects the victim's browser context, enabling session token theft or authenticated action injection against WordPress users.

An attacker identifies a public-facing WordPress page hosting a Forminator form with Stripe Checkout Sessions enabled - identifiable by inspecting page source for Forminator Stripe initialization markup - and constructs a URL to that page with a JavaScript payload embedded in the 'error_description' parameter, mimicking the redirect pattern Stripe uses after a failed payment. The attacker delivers this crafted URL to a target user (e.g., a site administrator) via phishing email or a compromised third-party site. When the victim navigates to the URL, front.stripe.js reads the unsanitized parameter and writes it to the DOM, executing the attacker's script in the victim's browser session, which could steal WordPress authentication cookies or perform authenticated admin actions.