CVE-2026-101335: Forminator Forms <= 1.58.1 - Unauthenticated Arbitrary Shortcode Execution via 'User-Agent' Header and 'referer_url' Parameter via Quiz Notification Merge Tags

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminatorreplacequizformdata() helper invoking doshortcode() on the fully expanded notification body once the {quizresult} merge tag has been substituted, while the earlier-substituted {useragent} and {referurl} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the refererurl POST parameter) through sanitizetextfield()/eschtml(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quizresult}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.