Description

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted Textarea field has the Rich-Text editor option enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-28T05:16:41.797Z",
  "pubdate": "2026-08-28T05:16:41.797Z",
  "executiveSummary": "The Forminator Forms plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw originates from inadequate input sanitization and output escaping within the Rich-Text Textarea field component.\nThe vulnerability allows unauthenticated attackers to inject malicious JavaScript payloads into form fields. These scripts are subsequently stored within the application database and executed within the context of any user session that views the affected page, including administrative sessions.\nThe impact is significant, as successful exploitation enables attackers to perform unauthorized actions on behalf of authenticated users, steal session cookies, exfiltrate sensitive data, or redirect users to malicious domains.\nThis vulnerability affects all versions of the Forminator plugin up to and including 1.57.0.1. Exploitation is contingent upon the specific configuration of the Rich-Text editor option within the targeted form field. Because the vulnerability does not require authentication, the risk level is critical, necessitating immediate attention from administrators to secure their WordPress environments.",
  "technicalDetails": "The vulnerability manifests as a result of improper handling of user-supplied data within the Rich-Text Textarea field of the Forminator Forms plugin. When the Rich-Text editor is enabled, the plugin fails to sufficiently sanitize incoming input or properly encode output before rendering it in the browser.\nThe root cause lies in a breakdown of the input validation and output encoding pipeline. By neglecting to apply robust sanitization filters to content submitted through the rich-text interface, the application permits the injection of arbitrary HTML and JavaScript tags. Because the plugin stores this data in the database, it creates a persistent Stored XSS condition.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies a form using the Forminator plugin with a Rich-Text Textarea field. The attacker crafts a malicious payload—typically JavaScript encapsulated within <script> tags or event handlers such as 'onerror' or 'onload' within HTML tags like <img> or <iframe>. This payload is submitted via the form field during standard interaction.\nUpon submission, the plugin saves the unsanitized payload into the WordPress database. When an administrator or a privileged user accesses the administrative dashboard or a frontend page where the submitted form data is displayed, the application retrieves the stored, malicious content and injects it directly into the Document Object Model (DOM).\nThe browser interprets the injected script as legitimate site content and executes it within the victim's session context. This grants the attacker the same origin permissions as the victim, allowing for the manipulation of DOM elements, the retrieval of session tokens via document.cookie, or the initiation of unauthorized background requests via the Fetch or XMLHttpRequest APIs.\nThe vulnerability is technically categorized as Stored XSS, where the persistence mechanism is the database storage of the form entry. It affects versions up to 1.57.0.1, and its exploitability relies entirely on the configuration of the Rich-Text Textarea component. There are no authentication requirements for an attacker to initiate the injection, as form submissions are generally public-facing, creating a substantial vector for unauthorized client-side code execution."
}