Forminator EUVD-2026-43426

Exploitation requires the victim to interact with attacker-controlled input - specifically opening a crafted URL or triggering a page element that Forminator's client-side JavaScript renders into the DOM without sanitization (UI:R in the CVSS vector). No authentication is required of the attacker to deliver the payload (PR:N), and the attack is network-reachable against affected installs running Forminator 1.55.0.1 or earlier. The key limiting factors are: (1) a user must click or visit the malicious link for the DOM sink to fire, and (2) impact severity scales with the privilege of the tricked user - stealing an administrator session is far more damaging than an anonymous visitor's. Because it is DOM-based, the payload may reside in the URL fragment and never reach the server, which limits server-side detection but does not change the prerequisite that a victim's browser must process the crafted input.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates network reach, low complexity, and no privileges, but crucially requires user interaction (UI:R), which is the primary limiting factor and is consistent with DOM-based XSS delivered via a crafted link. The scope change (S:C) reflects that script executes in the victim's browser context, potentially affecting resources beyond the vulnerable component. No EPSS score was supplied and the CVE is not in CISA KEV, so there is no evidence of active exploitation; no public exploit identified at time of analysis. Realistically this is a meaningful but not emergency-tier issue: XSS in a high-install plugin is attractive for session or admin-cookie theft, but the requirement for a victim to click a crafted link makes it targeted and social-engineering-dependent rather than wormable. The impact metrics (C:L/I:L/A:L) are somewhat generous for XSS; availability impact in particular is questionable and is reflected in my independent reassessment below.

An attacker crafts a URL to a page on the target WordPress site that embeds a malicious script payload in a location Forminator's client-side code reflects into the DOM (such as a URL fragment or query parameter). The attacker sends this link to a logged-in administrator or editor via phishing; when the victim opens it, the script executes in their authenticated session and can exfiltrate cookies, forge admin actions, or plant persistent content. No public exploit code was identified at time of analysis, and success depends on the victim clicking the crafted link (UI:R).