CVE-2026-92144 in Forminator Forms Plugin
Summary
by MITRE • 10/01/2026
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form submission nonce is freely obtainable by unauthenticated users via the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint, making the full attack chain exploitable without any authentication or prior account.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/01/2026
The Forminator Forms plugin for WordPress contains a critical security vulnerability affecting all versions up to and including 1.57.2. This flaw is classified as a Stored Cross-Site Scripting (XSS) issue, specifically identified under the Common Weakness Enumeration standard as CWE-79. The vulnerability resides within the postdata-1[post-custom] parameter used during form submissions. Due to insufficient input sanitization and output escaping mechanisms within the plugin's codebase, malicious actors are able to inject arbitrary web scripts into stored data fields on the server side. Unlike reflected XSS attacks that require user interaction with a crafted link, this vulnerability allows attackers to persist their payload in the database, ensuring execution whenever any victim views the affected page or form submission result.
The operational impact of this vulnerability is severe because it enables unauthenticated remote code execution within the context of the victim's browser session. An attacker can craft malicious scripts that steal sensitive information such as administrative cookies, session tokens, or personal data entered into forms. These injected scripts can also perform actions on behalf of the user, potentially leading to account takeover if an administrator views a compromised page. The persistence of the payload means that every subsequent visit by any user to the infected content triggers the malicious code, creating a widespread and continuous threat vector without further effort from the attacker after initial injection.
A critical factor in the exploitability of this vulnerability is the accessibility of the required form submission nonce. Typically, WordPress security relies on nonces to prevent Cross-Site Request Forgery by ensuring that requests originate from legitimate sources within an authenticated session. However, in this case, the wp_ajax_nopriv_forminator_get_nonce endpoint allows unauthenticated users to freely obtain valid nonces. This design flaw effectively neutralizes one of the primary defense mechanisms against unauthorized form submissions. Consequently, attackers do not need prior authentication or a user account to exploit the vulnerability. They can retrieve a fresh nonce on demand and use it to submit malicious payloads directly through the public-facing interface, making the full attack chain fully exploitable by any internet-connected individual with basic web exploitation knowledge.
To mitigate this risk, site administrators must immediately update the Forminator Forms plugin to version 1.57.3 or later, where these input sanitization and output escaping issues have been addressed. If immediate updating is not possible due to compatibility concerns, temporary mitigations include implementing a Web Application Firewall that can detect and block XSS payloads in form submission parameters. Additionally, reviewing server-side logs for unusual patterns of nonce requests followed by rapid form submissions may help identify ongoing exploitation attempts. It is also advisable to audit any forms created with the plugin for signs of injected content or unexpected script tags within submitted data fields. Ensuring that all WordPress core components and plugins are kept up to date remains a fundamental best practice in maintaining overall site security posture against such vulnerabilities aligned with MITRE ATT&CK techniques related to client-side injection and persistence mechanisms.