CVE-2026-18328: Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only triggerable on pages hosting a Forminator form configured to use the Stripe Checkout Sessions payment API, which became the default in 1.56.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Forminator Forms pluginto a version that resolves this vulnerability.Fixed in 1.57.0
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using Forminator Forms version 1.57.0 or earlier are exposed only on pages that host a Forminator form configured to use the Stripe Checkout Sessions payment API. This API became the default configuration in version 1.56.0.
Does an attacker need an account or user interaction to exploit it?
No account or privileges are required. An attacker can inject web script through the error_description parameter, and the script executes when a user visits the affected page.
What is the impact if exploitation succeeds?
The injected script runs in the context of a user visiting the affected form page. The provided severity vector indicates potential confidentiality and integrity impact, with no availability impact.