Forminator Forms CVE-2026-85235

Injection requires only that a public-facing Forminator form containing a Rich-Text Textarea field exists and accepts unauthenticated submissions (default-reachable). Execution, however, is gated on a logged-in administrator opening the specific stored submission in the Forminator Entries view (wp-admin) AND clicking the attacker's planted link, which triggers WordPress core's jQuery .contextual-help-tabs a click handler to evaluate the entity-decoded href. Limiting factors: requires a form with a rich-text textarea field in use, requires high-privilege victim (administrator) interaction, and depends on the specific WP-core click-handler behavior - so despite the unauthenticated injection, payload firing is not automatic.

CVSS 3.1 7.2 (HIGH) is driven largely by the scope change (S:C) and the vendor's choice of UI:N and PR:N. However, the description itself contradicts UI:N: successful exploitation 'requires an administrator to open the stored submission entry in the Forminator Entries view and interact with the planted link.' That is clearly user interaction (UI:R) by a high-privilege victim, which materially lowers real-world exploitability versus a no-interaction stored XSS. The injection step is genuinely unauthenticated (PR:N, AV:N, AC:L) via a public form submission, but the payload only fires once an admin both views the entry and clicks the attacker's crafted link, relying on an unusual WordPress-core jQuery quirk (the .contextual-help-tabs a click handler evaluating the entity-decoded href as HTML). Impact is limited to C:L/I:L (no availability impact). There is no EPSS score, no CISA KEV listing, and no public exploit provided in the input - exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. Net: this is a real but conditional stored XSS whose headline 7.2 overstates practical risk because it omits the required admin interaction; treat as a standard 'patch promptly' item for a widely-used plugin rather than an emergency, and verify the UI:N claim with the vendor.

An unauthenticated attacker submits a Forminator form whose Rich-Text Textarea field contains an entity-encoded payload embedded in a link; the content survives sanitization and is stored as a form entry. Later a site administrator opens that submission in the wp-admin Forminator Entries view and clicks the planted link, at which point WordPress core's jQuery click handler on .contextual-help-tabs a decodes and evaluates the href as HTML, executing the attacker's script in the admin's authenticated session. No public proof-of-concept was included in the provided data.