What the vulnerability does
01Description
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only triggerable on pages hosting a Forminator form configured to use the Stripe Checkout Sessions payment API, which became the default in 1.56.0.
Explanation of Vulnerability in Simple Terms
02Summary
Forminator Forms versions up to 1.57.0 contain a cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users. The vulnerability affects the form builder's handling of user input and can impact site visitors across the affected installation. No authentication or user interaction is required to exploit this issue.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in other users' browsers when they view affected pages.
Potential impact on your site
04Site Impact
Visitors and admins may have malicious scripts executed in their browsers, risking credential theft or malware infection.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
August 25, 2026
CVE published
