EUVD-2026-53945
GHSA-5hmx-3p59-84jf
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
AV:N and PR:N because form submission requires no auth; UI:R for victim rendering; S:C for browser context crossing; A:N as XSS does not directly impact availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.
AnalysisAI
Cross-site scripting in Forminator WordPress plugin (WPMU DEV) versions up to and including 1.56.0 enables unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered by affected WordPress installations. The CVSS vector (PR:N, S:C) confirms no authentication is required to plant the payload, while victim interaction (UI:R) is necessary for execution - consistent with a stored or reflected XSS pattern where a privileged user (e.g., site administrator) must view attacker-controlled content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target WordPress site to have the Forminator plugin installed and activated in version 1.56.0 or earlier, with at least one publicly accessible form present on the site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The 7.1 CVSS base score reflects a moderate-to-high network-accessible XSS with no authentication barrier for payload delivery, but requires victim interaction (UI:R), tempering the immediacy of exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a Forminator form with a JavaScript payload embedded in a form field (e.g., a name or message input). When a WordPress administrator navigates to the form submissions view in the WordPress back-end, the unsanitized payload executes in the admin's browser session - potentially exfiltrating the admin's session cookie or WordPress nonce to an attacker-controlled endpoint, granting full administrative site access. … |
| Remediation | The primary remediation is to update Forminator to a version above 1.56.0 via the WordPress admin dashboard (Plugins → Updates) or the WordPress CLI with 'wp plugin update forminator'. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify those running Forminator version 1.56.0 or earlier and classify by business criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Forminator
View allThe Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after
The Forminator plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has SQL Injection via the wp-admin/ad
The Forminator WordPress plugin before 1.24.4 does not properly escape values that are being reflected inside form field
The "Forminator Contact Form, Poll & Quiz Builder" plugin before 1.6 for WordPress has XSS via a custom input field of a
Unauthenticated PHP Object Injection in the Forminator WordPress plugin (WPMU DEV) affects all versions up to and includ
The Forminator - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Cross-Site Reque
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary
Privilege escalation in the Forminator WordPress plugin (≤1.56.0) allows authenticated Contributor-level users to elevat
The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission s
The Forminator WordPress plugin before 1.15.4 does not sanitize and escape the email field label, which could allow high
The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to PHP Object
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today