CVE-2026-116858: WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability

Q: Which installations are affected?

Forminator versions through 1.58.3 are affected. The available information does not state whether any particular Forminator configuration or feature must be enabled.

Q: What level of access does an attacker need?

The CVSS vector indicates that an attacker needs low-level privileges and can exploit the issue remotely without user interaction. The data does not identify the specific WordPress role or Forminator permission required.

Q: What is the potential impact?

The issue is classified as basic XSS/content injection and has low confidentiality impact, with no stated integrity or availability impact. An attacker may be able to inject script-related HTML content.

Published Nov 3, 2026

Updated

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code Injection.This issue affects Forminator: from n/a through 1.58.3.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Forminator plugin to a version that resolves this vulnerability.
Fixed in 1.58.4

Event History

Nov 3, 2026

CVE Published

via MITRE·04:45 PM

Data Sourced

via MITRE·04:45 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

Forminator versions through 1.58.3 are affected. The available information does not state whether any particular Forminator configuration or feature must be enabled.

What level of access does an attacker need?

The CVSS vector indicates that an attacker needs low-level privileges and can exploit the issue remotely without user interaction. The data does not identify the specific WordPress role or Forminator permission required.

What is the potential impact?

The issue is classified as basic XSS/content injection and has low confidentiality impact, with no stated integrity or availability impact. An attacker may be able to inject script-related HTML content.

CVE-2026-116858: WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What level of access does an attacker need?

What is the potential impact?