CVE-2026-18323: Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Radio Field (Save and Continue Draft) in all versions up to, and including, 1.57.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because the Save-and-Continue draft submission AJAX endpoint is registered as nopriv, allowing unauthenticated attackers to bypass radio field option-membership validation and persist a crafted payload that, when rendered on the Submissions admin page, is auto-executed via the bundled Inputmask library's data-attribute callback binding.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what access do they need?
Any unauthenticated remote attacker can exploit it. The Save-and-Continue draft submission AJAX endpoint is registered for unauthenticated use, so no WordPress account or prior access is required.
What conditions are required for the injected script to run?
An attacker must submit a crafted payload through a radio field using the Save-and-Continue draft functionality. The payload executes when a user accesses the affected submission on the Submissions admin page.
Are default deployments affected?
The issue affects all Forminator Forms versions through 1.57.0.2 because the relevant Save-and-Continue endpoint is available to unauthenticated users. Exploitation specifically relies on a form with a radio field and the draft submission path.
How can administrators determine whether they may have been targeted?
Review Forminator draft submissions, particularly entries containing unexpected or malformed radio-field values. Pay particular attention to submissions that trigger suspicious behavior when viewed in the Submissions admin page.