What is the CVSS score of CVE-2026-57814?

CVE-2026-57814 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Forminator are affected by CVE-2026-57814?

The WPMU DEV Forminator WordPress plugin (versions ≤1.55.0.1) contains a DOM-based cross-site scripting vulnerability that enables attackers to inject malicious JavaScript into website visitors'…

How to fix or mitigate CVE-2026-57814?

Within 24 hours, audit WordPress installations to identify affected Forminator plugin versions (1.55.0.1 and earlier) and segregate impacted sites from user-facing traffic if possible. Over the next 7 days, implement Web Application Firewall (WAF) rules to detect and block DOM-based XSS patterns targeting Forminator form fields, enforce Content Security Policy (CSP) headers to restrict script execution, and disable the plugin if business-critical functionality can be deferred. Within 30 days, monitor WPMU DEV's security advisories for a patched version and establish a plan for immediate deployment once available; consider migrating to alternative form solutions if the vendor's patch timeline exceeds organizational risk tolerance.

Forminator CVE-2026-57814

EUVD-2026-43426 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

XSS WordPress Forminator

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

DOM-based XSS is network-reachable with no privileges but needs victim interaction (UI:R); browser-context execution justifies S:C and C:L/I:L, while availability impact is not realistic, so A:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:25 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows DOM-Based XSS.This issue affects Forminator: from n/a through <= 1.55.0.1.

Articles & Coverage 2

News 13 New WordPress Vulnerabilities - 1 Critical, 12 High, 4 With POC Jul 14, 2026 News 3 New WordPress Vulnerabilities - 3 High Severity Jul 13, 2026

AnalysisAI

DOM-based cross-site scripting in the WPMU DEV Forminator WordPress plugin (versions up to and including 1.55.0.1) allows remote attackers to execute arbitrary JavaScript in a victim's browser when the victim interacts with a maliciously crafted link or page element. Reported by Patchstack and rated CVSS 7.1, the flaw carries a scope-changing impact but requires user interaction; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Forminator is a widely used WordPress form-builder plugin (contact forms, polls, quizzes, payment forms) from WPMU DEV. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation, specifically a DOM-based variant where client-side JavaScript writes attacker-influenced data (for example URL fragments, query parameters, or form-rendering values) into the page DOM without proper sanitization or output encoding. Because the sink executes in the browser rather than server-side, the malicious payload never needs to be stored on the server, and standard server-side WAF inspection of request bodies may miss fragment-based payloads. The affected CPE is cpe:2.3:a:wpmu_dev_-_your_all-in-one_wordpress_platform:forminator:*:*:*:*:*:*:*:* covering all builds from initial release through 1.55.0.1.

RemediationAI

Upgrade Forminator to the next release published after 1.55.0.1; the fixed version is not explicitly stated in the provided data and should be confirmed directly from the Patchstack advisory or the WordPress.org plugin changelog before deployment (Patch available per vendor advisory, released patched version not independently confirmed). Consult the advisory at https://patchstack.com/database/Wordpress/Plugin/forminator/vulnerability/wordpress-forminator-plugin-1-55-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve for the exact patched build. Until patched, compensating controls include adding a restrictive Content-Security-Policy header that disallows inline script execution (trade-off: may break plugins or themes relying on inline JS and requires testing), deploying WAF rules that inspect request URIs and known Forminator parameters for script and HTML-encoding patterns (note: fragment-based DOM XSS payloads after '#' are never sent to the server and cannot be blocked this way), and temporarily deactivating Forminator on high-value sites where forms are non-essential. Advising administrators and editors not to click untrusted links pointing to their own site also reduces the interaction-dependent exposure.