Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T13:17:25.347Z",
  "pubdate": "2026-11-06T13:17:25.347Z",
  "executiveSummary": "The WPMU DEV Forminator plugin is affected by an Improper Neutralization of Input During Web Page Generation vulnerability, specifically categorized as a Stored Cross-site Scripting (XSS) flaw.\nThis vulnerability exists in all versions of the Forminator plugin from n/a through 1.58.3, allowing unauthorized attackers to inject and persist malicious scripts within the application.\nThe primary risk involves the execution of arbitrary JavaScript in the context of a victim's browser session when they view the compromised form data or administrative dashboard.\nSuccessful exploitation allows attackers to perform actions on behalf of authenticated users, potentially leading to unauthorized data access, session hijacking, or defacement of the affected website.\nThe vulnerability does not necessarily require high-level administrative privileges for initial payload injection, provided the attacker can interact with form submission endpoints.\nOrganizations utilizing affected versions of Forminator are at risk of client-side attacks that bypass standard security boundaries if input is not properly sanitized before being rendered in the web interface.",
  "technicalDetails": "The root cause of this vulnerability is the improper sanitization and output encoding of user-supplied data within the WPMU DEV Forminator plugin. When a user submits data through a Forminator form, the application fails to adequately neutralize malicious input before storing it in the database and subsequently rendering it in the administrative backend or frontend views.\nAs a Stored XSS vulnerability, the attack flow begins with the malicious actor submitting a crafted payload—typically containing JavaScript snippets such as <script>alert(document.cookie)</script>—into a vulnerable form field. The application processes this input and commits the unsanitized payload to the database associated with the Forminator plugin.\nThe vulnerability is triggered when an administrator or another user accesses the section of the plugin where the submitted form entries are displayed. The server retrieves the stored malicious payload from the database and embeds it directly into the HTML response without context-aware output encoding. The victim's browser then parses this response and executes the embedded script in the context of the current session.\nThe scope of impact is highly dependent on the privileges of the user viewing the compromised entry. If an administrator views the submission, the injected script executes with administrative privileges, which could allow for the creation of new administrative accounts, modification of site configurations, or redirection of traffic to malicious external domains.\nThis vulnerability is classified as Stored XSS because the payload persists within the system's storage mechanism. It remains effective until the entry is deleted or the malicious content is sanitized, ensuring that every user who loads the malicious entry is subjected to the payload. The lack of robust input validation at the entry point of the form handler facilitates this injection, circumventing the intended use of the input fields.\nThe exploitation process typically does not require specialized technical expertise once the vulnerability is identified, as it relies on the application's failure to distinguish between user data and executable code. Without strict Content Security Policy (CSP) implementation or server-side input validation, the application remains vulnerable to various forms of client-side exploitation, including session token theft, unauthorized data exfiltration, and unauthorized administrative actions."
}