Forminator Forms EUVD-2026-90595

Exploitable against default configurations of any site running Forminator ≤1.57.2 that exposes a published form containing a Post Data field (the 'postdata-1[post-custom]' custom-fields input). The attacker needs no account: the normally-required submission nonce is obtainable by anyone through the unauthenticated wp_ajax_nopriv_forminator_get_nonce endpoint. The principal limiting factor is that payload execution requires a victim to subsequently view the injected page or submission (an admin reviewing entries, or a visitor loading the created/updated post), so impact is deferred until that view occurs; a site with no Post Data-type form field is not affected.

This is a genuinely serious issue that stands out from the usual run of WordPress plugin XSS reports. The Wordfence-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N = 7.2) describes fully remote, unauthenticated, low-complexity stored XSS with a scope change, and the description substantiates the hardest-to-believe metric (PR:N): although Forminator form submission normally requires a nonce, that nonce is freely retrievable by anyone via the publicly exposed wp_ajax_nopriv_forminator_get_nonce AJAX endpoint, so the nonce is not a real authorization control here. That closes the gap that often downgrades 'unauthenticated' plugin findings to practically-authenticated ones. Exploitation status is 'no public exploit identified at time of analysis' - there is no EPSS score, no CISA KEV listing, and no POC referenced in the inputs; absence of these is not reassurance, only an absence of signal. The one metric I would push back on is UI: real-world execution requires a victim (often an administrator reviewing submissions or a visitor loading the injected post/page), so UI:R is defensible and would modestly lower the score, but the C:L/I:L/A:N impact ceiling is correct for reflected-into-stored script execution rather than direct data theft or RCE. Net: for a very widely deployed plugin this is a real patching priority driven by the unauthenticated + stored + scope-change combination, not an inflated-CVSS paper tiger - though it is not evidence of active exploitation.

An unauthenticated attacker first calls the public wp_ajax_nopriv_forminator_get_nonce endpoint to obtain a valid form submission nonce, then submits a Forminator form containing a crafted 'postdata-1[post-custom]' value carrying a JavaScript payload, which is stored without sufficient sanitization. When an administrator reviews the submission or any user visits the resulting injected page, the script executes in their browser session. No authentication, account, or special user interaction beyond normal page viewing is required, and no public exploit code is referenced at this time.