EUVD-2026-43426Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
DOM-based XSS is network-reachable with no privileges but needs victim interaction (UI:R); browser-context execution justifies S:C and C:L/I:L, while availability impact is not realistic, so A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows DOM-Based XSS.This issue affects Forminator: from n/a through <= 1.55.0.1.
Articles & Coverage 2
AnalysisAI
DOM-based cross-site scripting in the WPMU DEV Forminator WordPress plugin (versions up to and including 1.55.0.1) allows remote attackers to execute arbitrary JavaScript in a victim's browser when the victim interacts with a maliciously crafted link or page element. Reported by Patchstack and rated CVSS 7.1, the flaw carries a scope-changing impact but requires user interaction; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to interact with attacker-controlled input - specifically opening a crafted URL or triggering a page element that Forminator's client-side JavaScript renders into the DOM without sanitization (UI:R in the CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates network reach, low complexity, and no privileges, but crucially requires user interaction (UI:R), which is the primary limiting factor and is consistent with DOM-based XSS delivered via a crafted link. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a URL to a page on the target WordPress site that embeds a malicious script payload in a location Forminator's client-side code reflects into the DOM (such as a URL fragment or query parameter). The attacker sends this link to a logged-in administrator or editor via phishing; when the victim opens it, the script executes in their authenticated session and can exfiltrate cookies, forge admin actions, or plant persistent content. … |
| Remediation | Upgrade Forminator to the next release published after 1.55.0.1; the fixed version is not explicitly stated in the provided data and should be confirmed directly from the Patchstack advisory or the WordPress.org plugin changelog before deployment (Patch available per vendor advisory, released patched version not independently confirmed). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit WordPress installations to identify affected Forminator plugin versions (1.55.0.1 and earlier) and segregate impacted sites from user-facing traffic if possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Forminator
View allThe Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after
The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/ad
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form field
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a
The Forminator - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Reque
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary
The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission s
The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object
The Forminator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. Rated high s
Arbitrary file download via path traversal in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today