CVE-2026-115952: WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability

Q: Which installations are affected?

Forminator versions through 1.58.3 are affected. The available information does not state whether any particular configuration or feature must be enabled.

Q: What is the potential impact of exploitation?

The vulnerability allows stored cross-site scripting. Malicious input could be saved and later executed in the browser of a user who views the affected web page or content.

Q: What should teams do to remediate this issue?

Update Forminator to a version later than 1.58.3 when one is available. The provided information does not identify a configuration-based workaround for systems that cannot be patched immediately.

Published Nov 6, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Forminator plugin to a version that resolves this vulnerability.
Fixed in 1.58.4

Event History

Nov 6, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Forminator versions through 1.58.3 are affected. The available information does not state whether any particular configuration or feature must be enabled.

What is the potential impact of exploitation?

The vulnerability allows stored cross-site scripting. Malicious input could be saved and later executed in the browser of a user who views the affected web page or content.

What should teams do to remediate this issue?

Update Forminator to a version later than 1.58.3 when one is available. The provided information does not identify a configuration-based workaround for systems that cannot be patched immediately.

CVE-2026-115952: WordPress Forminator plugin <= 1.58.3 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What is the potential impact of exploitation?

What should teams do to remediate this issue?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What is the potential impact of exploitation?

What should teams do to remediate this issue?