DOM-Based Reflected Cross-Site Scripting in Forminator Forms Plugin for WordPress
CVE-2026-18328

7.2HIGH

Key Information:

Vendor

WordPress
Status
Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Vendor
CVE Published:
25 August 2026

What is CVE-2026-18328?

The Forminator Forms plugin for WordPress contains a security vulnerability that allows unauthorized attackers to exploit the 'error_description' parameter, resulting in the injection of arbitrary web scripts. This vulnerability occurs due to inadequate input sanitization and output escaping practices. The issue is present in all versions up to 1.57.0 and can be triggered on pages containing a Forminator form configured to integrate with the Stripe Checkout Sessions payment API, which became the default in version 1.56.0. Users who access these compromised pages may have their sessions hijacked or suffer from malicious script executions.

Affected Version(s)

Forminator Forms – Contact Form, Payment Form & Custom Form Builder 0 <= 1.57.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/forminator/tag...
https://plugins.trac.wordpress.org/browser/forminator/tag...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Adrien Brunner
.