What is the CVSS score of CVE-2026-28143?

CVE-2026-28143 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Forminator are affected by CVE-2026-28143?

Forminator WordPress plugin (WPMU DEV) versions through 1.56.0 contain an unauthenticated cross-site scripting vulnerability that allows attackers to inject malicious scripts into affected websites.

How to fix or mitigate CVE-2026-28143?

Within 24 hours, audit all WordPress installations to identify those running Forminator version 1.56.0 or earlier and classify by business criticality. Within 7 days, for critical instances, either disable the Forminator plugin entirely or implement WAF rules blocking XSS payloads targeting form submission endpoints and form parameter fields. Within 30 days, actively monitor WPMU DEV security advisories and Patchstack for a vendor-released patch; prepare and test an upgrade plan to deploy the patched version immediately upon availability.

Forminator CVE-2026-28143

EUVD-2026-53945 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-5hmx-3p59-84jf

WordPress XSS Forminator Wordpress Plugin Wpmu Dev

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

AV:N and PR:N because form submission requires no auth; UI:R for victim rendering; S:C for browser context crossing; A:N as XSS does not directly impact availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:21 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

AnalysisAI

Cross-site scripting in Forminator WordPress plugin (WPMU DEV) versions up to and including 1.56.0 enables unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered by affected WordPress installations. The CVSS vector (PR:N, S:C) confirms no authentication is required to plant the payload, while victim interaction (UI:R) is necessary for execution - consistent with a stored or reflected XSS pattern where a privileged user (e.g., site administrator) must view attacker-controlled content. No public exploit code or active exploitation has been identified at time of analysis; this is a researcher-reported disclosure via Patchstack.

Technical ContextAI

Forminator is a drag-and-drop form builder WordPress plugin developed by WPMU DEV, identified in CPE as cpe:2.3:a:wpmu_dev:forminator:*:*:*:*:*:*:*:*. The vulnerability class is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-Site Scripting), indicating the plugin fails to adequately sanitize or encode attacker-supplied input before rendering it in an HTML context. Because the CVSS assigns PR:N (no privileges required to introduce the payload) and S:C (scope changed, meaning the vulnerable component's trust boundary is crossed), the flaw most likely involves input accepted from unauthenticated form submissions that is later rendered unsanitized in the WordPress admin interface or on a public-facing page. The Scope:Changed designation is characteristic of XSS, where code originating in one security context (an untrusted form submission) executes in another (a victim's browser session with higher privilege).

RemediationAI

The primary remediation is to update Forminator to a version above 1.56.0 via the WordPress admin dashboard (Plugins → Updates) or the WordPress CLI with 'wp plugin update forminator'. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-56-0-cross-site-scripting-xss-vulnerability should be consulted for the confirmed patched version, as the exact fix version is not independently confirmed from the provided data. If immediate patching is not possible, compensating controls include: restricting access to form submission endpoints via WAF rules that block common XSS patterns in POST body parameters (trade-off: may cause false positives on legitimate user input); applying a WAF virtual patch if using Patchstack's own firewall product, which typically provides coverage for Patchstack-disclosed vulnerabilities; and limiting admin-panel exposure by IP allowlisting to reduce the attack surface for any stored payload execution. Note: none of these workarounds eliminate the underlying unsanitized input flaw.