What is the CVSS score of EUVD-2026-39384?

EUVD-2026-39384 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Forminator are affected by EUVD-2026-39384?

Forminator WordPress plugin versions 1.53.1 and earlier contain a cross-site scripting (XSS) vulnerability allowing unauthenticated attackers to inject malicious scripts that execute in visitor…

How to fix or mitigate EUVD-2026-39384?

Within 24 hours: Audit all WordPress installations for Forminator plugin version 1.53.1 or earlier; document affected systems and user exposure. Within 7 days: Implement compensating controls (see below) and restrict plugin access if operationally feasible; contact WPMU DEV support for patch timeline. Within 30 days: Monitor WPMU DEV security advisories for patch release; establish and test emergency update deployment procedures.

Forminator EUVD-2026-39384

| CVE-2026-56071 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-25 Patchstack

GHSA-h3hf-xcf9-4v9v

WordPress XSS Forminator Wordpress Plugin Wpmu Dev

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network-reachable XSS (AV:N/PR:N) needs victim interaction (UI:R) and executes in a changed browser scope (S:C) with limited C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 14:24 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.

AnalysisAI

Cross-site scripting in the Forminator WordPress plugin (versions 1.53.1 and earlier, by WPMU DEV) lets unauthenticated remote attackers inject malicious script that executes in a victim's browser when they interact with crafted content. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C, score 7.1) confirms no authentication is required but that user interaction triggers the payload, and the changed scope means the injected script runs in a security context beyond the vulnerable component. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Forminator is a widely-used WordPress form-builder plugin (cpe:2.3:a:wpmu_dev:forminator) that renders user-supplied input across contact forms, polls, and quizzes. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-controlled data is reflected or stored into HTML output without adequate encoding or sanitization, allowing it to be parsed as active script by the browser. The CVSS scope-changed flag (S:C) is consistent with XSS, where the vulnerable plugin emits markup that then executes in the broader browser/session context of any user viewing the affected page.

RemediationAI

No vendor-released patch version was identified in the provided data; the affected range is up to and including 1.53.1, so the primary action is to upgrade Forminator to the latest available release beyond 1.53.1 via the WordPress plugin updater and confirm the fixed version against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-53-1-cross-site-scripting-xss-vulnerability). Until an upgrade is applied, deploy a Web Application Firewall rule (Patchstack and similar WAFs offer virtual patches) to filter script-injection payloads against Forminator endpoints, which adds latency and may produce false positives on legitimate rich input; alternatively, restrict or disable public-facing Forminator forms that accept free-text input, accepting the trade-off of lost form functionality. Adding a restrictive Content-Security-Policy header limits script execution as a defense-in-depth measure but can break legitimate inline scripts on the site.