CVE-2026-18323 in Forminator Plugin
Summary
by MITRE • 08/25/2026
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the Save-and-Continue draft submission AJAX endpoint is registered as nopriv, allowing unauthenticated attackers to bypass radio field option-membership validation and persist a crafted payload that, when rendered on the Submissions admin page, is auto-executed via the bundled Inputmask library's data-attribute callback binding.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/25/2026
The Forminator Forms plugin for WordPress contains a critical security vulnerability affecting all versions up to 1.57.0.2, specifically within its Save and Continue Draft functionality for radio fields. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue resulting from insufficient input sanitization and output escaping mechanisms during the processing of form submissions. The core technical deficiency lies in how the plugin handles data submitted through AJAX endpoints that are registered with public access permissions, commonly referred to as nopriv routes. Because these endpoints do not require authentication, unauthenticated attackers can interact directly with the submission logic without needing valid credentials or session tokens typically required for administrative actions.
The exploitation vector centers on the radio field option-membership validation process. Attackers can bypass standard membership checks by crafting specific HTTP requests to the Save and Continue Draft AJAX endpoint. By injecting malicious JavaScript payloads into the radio field options, these attackers ensure that the crafted data is persisted in the WordPress database rather than being discarded or sanitized. The vulnerability is particularly severe because it allows for persistent storage of executable code within legitimate form submission records. This means that every time an administrator views the submissions associated with a compromised form, the malicious script becomes part of the rendered page content.
The execution mechanism relies on the interaction between the stored payload and the Inputmask library bundled with WordPress or the plugin itself. The vulnerability is triggered when the Submissions admin page renders the saved radio field data. The Inputmask library utilizes data-attribute callback bindings to handle input formatting, which inadvertently executes any JavaScript code present in specific attributes of the DOM elements being rendered. Consequently, when an administrator loads the submissions list, the browser automatically parses and executes the injected scripts within the context of the admin dashboard. This results in a successful Stored XSS attack where the malicious code runs with the privileges of the viewing user.
The operational impact of this vulnerability is significant due to its potential for privilege escalation and data compromise. Since the script executes in the administrative interface, an attacker can perform actions on behalf of any administrator who views the affected submissions page. This includes creating new admin users, modifying site settings, accessing sensitive database information, or defacing the website. The lack of authentication requirements for the initial injection phase makes this vulnerability highly accessible to automated scanning tools and opportunistic attackers targeting WordPress installations with outdated Forminator versions.
From a standards perspective, this flaw aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. The specific mechanism involving the persistence of data in a database before rendering it to users without proper sanitization is characteristic of Stored XSS attacks. Furthermore, the exploitation technique maps to MITRE ATT&CK techniques related to Client-side Execution and potentially Account Manipulation if used for privilege escalation. The use of nopriv endpoints that lack adequate validation represents a common architectural weakness where public-facing APIs are not subjected to the same rigorous security checks as authenticated administrative functions.
Mitigation strategies must focus on immediate remediation through software updates and enhanced input handling practices. Administrators should upgrade the Forminator Forms plugin to version 1.57.0.3 or later, which addresses these sanitization gaps by implementing stricter validation for radio field options during the save process. Developers reviewing similar codebases should ensure that all AJAX endpoints performing data persistence enforce appropriate capability checks and apply rigorous output escaping before storing user-supplied content in the database. Additionally, implementing Content Security Policy headers can help mitigate the impact of any residual XSS vulnerabilities by restricting the sources from which scripts are allowed to execute within the browser environment.