CVE-2026-92144: Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form submission nonce is freely obtainable by unauthenticated users via the publicly accessible wpajaxnoprivforminatorgetnonce endpoint, making the full attack chain exploitable without any authentication or prior account.
Affected Software
Event History
Frequently Asked Questions
Which installations should be prioritized for triage?
WordPress sites using the WPMU DEV Forminator Forms plugin at version 1.57.2 or earlier are affected.
Does an attacker need a WordPress account or other prior access?
No. The vulnerability is exploitable without authentication or a prior account because the required form-submission nonce can be obtained through the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint.
What is required for exploitation?
An attacker needs to submit malicious script content through the postdata-1[post-custom] parameter. The issue results from insufficient input sanitization and output escaping.
What is the likely impact if exploitation succeeds?
Injected scripts are stored and execute when a user visits an affected page. This can compromise the confidentiality and integrity of actions performed in that user's browser session.