CVE-2026-18324: Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted Textarea field has the Rich-Text editor option enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Forminator Formsto a version that resolves this vulnerability.Fixed in 1.57.0.1 - Configuration
Disable the Rich-Text editor option for the targeted Textarea field(s) because exploitation requires the Rich-Text editor option to be enabled.
WordPress Forminator Forms rich-text textarea field Rich-Text editor option = disable
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Forminator Forms versions up to and including 1.57.0.1 are affected when a targeted Textarea field has the Rich-Text editor option enabled. Forms without that option enabled do not meet the stated exploitation condition.
Does an attacker need an account or user interaction to inject the payload?
No. The vulnerability can be exploited by an unauthenticated attacker, and the vector is network-accessible with low attack complexity. A user must later access a page containing the injected content for the stored script to execute.
What is the impact after a successful injection?
An attacker can store arbitrary web scripts in affected pages. The scripts execute in the browser of users who access those injected pages, with stated confidentiality and integrity impacts and changed scope.