CVE-2026-85235: Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to open the stored submission entry in the Forminator Entries view and interact with the planted link, at which point WordPress core's jQuery-based click handler on .contextual-help-tabs a evaluates the entity-decoded href as HTML, firing the attacker's payload in the administrator's authenticated wp-admin session.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger the issue?
An unauthenticated attacker must submit a payload through a Rich-Text Textarea field so it is stored in a form entry. Exploitation completes only when an administrator opens that entry in the Forminator Entries view and interacts with the planted link.
Who is exposed to the payload?
The payload is designed to execute in the authenticated WordPress administrator session of the administrator who reviews and clicks the malicious link. The issue does not describe execution merely from submitting the form or from a visitor viewing a normal site page.
Are installations using affected versions vulnerable without attacker authentication?
Yes. Versions up to and including 1.57.2 are affected, and the attacker does not need authentication to submit the stored payload. Administrator interaction with the crafted link remains necessary for execution.