CVE-2026-28143: WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability

Published Aug 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.56.0 versions.

Affected Software

1 affected component

WordPress Forminator plugin<=1.56.0

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Forminator plugin to a version that resolves this vulnerability.
Fixed in 1.56.1

Aug 6, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

RemedyDescriptionSeverityWeakness

The severity of CVE-2026-28143 is high with a score of 7.1.

CVE-2026-28143 affects the WordPress Forminator plugin version 1.56.0 and earlier.

CVE-2026-28143 is an unauthenticated Cross Site Scripting (XSS) vulnerability.

To fix CVE-2026-28143, update the WordPress Forminator plugin to version 1.56.1 or later.

CVE-2026-28143 could allow attackers to execute malicious scripts in the browser of unsuspecting users.