CVE-2026-18325 in Forminator Forms Plugin
Summary
by MITRE • 08/06/2026
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is possible because Forminator_Core::sanitize_array() skips all filtering for keys prefixed with 'select-', and set_field_data() treats a submitted 'return' member as a trusted internal flag — allowing an unauthenticated attacker to forge and persist a complete upload field record with an arbitrary file_url value without any sanitization or validation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability identified in the Forminator Forms plugin represents a critical stored cross-site scripting weakness that affects versions up to and including 156.1. This security flaw stems from inadequate input sanitization and output escaping mechanisms within the plugin's core processing functions. The vulnerability is particularly concerning as it allows unauthenticated attackers to inject malicious web scripts into pages that will execute whenever any user accesses those compromised pages, creating a persistent threat vector that can affect all users of the affected WordPress installation.
The technical exploitation mechanism revolves around the Forminator_Core::sanitize_array() function which deliberately bypasses all filtering for array keys that are prefixed with 'select-'. This design decision creates an exploitable gap in the sanitization process where attackers can manipulate form field data without proper validation. Additionally, the set_field_data() method treats a submitted 'return' member as a trusted internal flag, effectively allowing attackers to forge complete upload field records with arbitrary file_url values. This combination of factors enables attackers to persist malicious code through forged upload records that bypass all sanitization and validation checks.
The operational impact of this vulnerability extends beyond simple script injection, creating potential pathways for more sophisticated attacks including credential theft, session hijacking, and malware distribution. Attackers can leverage this vulnerability to compromise user sessions, steal sensitive information from authenticated users, or redirect victims to malicious websites. The stored nature of the XSS means that once the malicious payload is injected, it remains active until manually removed from the database, potentially affecting countless users over extended periods without detection.
Security practitioners should implement immediate mitigations including disabling or removing the vulnerable plugin until a patched version is available, implementing web application firewalls to filter suspicious input patterns, and monitoring affected systems for signs of exploitation. The vulnerability aligns with CWE-79 (Cross-site Scripting) and follows ATT&CK techniques related to persistent threats through web application exploitation. Organizations should also conduct thorough security audits of their WordPress installations to identify other potentially vulnerable plugins and ensure proper input validation across all user-submitted data processing functions.
The root cause demonstrates poor secure coding practices where trust is placed in internal flag values without proper validation, combined with insufficient sanitization for specific field types. This vulnerability underscores the critical importance of implementing defense-in-depth strategies including proper input validation, output encoding, and least privilege principles in web application development. Regular security assessments and timely patch management are essential to prevent exploitation of similar vulnerabilities in other components of the WordPress ecosystem.