What the vulnerability does
01Description
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is possible because Forminator_Core::sanitize_array() skips all filtering for keys prefixed with 'select-', and set_field_data() treats a submitted 'return' member as a trusted internal flag — allowing an unauthenticated attacker to forge and persist a complete upload field record with an arbitrary file_url value without any sanitization or validation.
Explanation of Vulnerability in Simple Terms
02Summary
Forminator Forms versions up to 1.56.1 contain a cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into the site without user interaction. The vulnerability affects the form builder's input handling, enabling attackers to execute JavaScript in visitors' browsers and potentially steal session data or redirect users. Site administrators should update to a version newer than 1.56.1 immediately.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in visitors' browsers and steals session data or redirects users.
Potential impact on your site
04Site Impact
Visitors' browsers can be compromised; session tokens and sensitive data may be stolen; site reputation damaged.
Conditions required to exploit
05Prerequisites
No authentication or user interaction required; attacker needs only network access to the site.
Key dates
06Disclosure timeline
August 6, 2026
CVE published
August 6, 2026
Record updated
