Stored Cross-Site Scripting Vulnerability in Forminator Forms Plugin for WordPress
CVE-2025-0469
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 27 February 2025
What is CVE-2025-0469?
The Forminator Forms plugin for WordPress, which allows users to create contact and payment forms, is susceptible to a stored cross-site scripting (XSS) vulnerability. This flaw arises from inadequate input sanitization and output escaping in the slider template data. Authenticated attackers with Contributor-level permissions or higher can exploit this vulnerability, allowing them to embed malicious web scripts into pages. These scripts execute whenever a user accesses the compromised page, potentially leading to unauthorized actions or data theft.
Affected Version(s)
Forminator Forms – Contact Form, Payment Form & Custom Form Builder 1.39.2