Stored Cross-Site Scripting Vulnerability in Forminator Forms Plugin for WordPress

CVE-2026-85235

What is CVE-2026-85235?

The Forminator Forms plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting due to inadequate input sanitization and output escaping. An unauthenticated attacker can exploit this flaw through the Rich-Text Textarea Field available in all versions up to and including 1.57.2. The security issue arises when an administrator accesses stored submission entries where the attacker can inject malicious web scripts. As the administrator interacts with the compromised submission, WordPress's jQuery-based click handler executes the attacker's payload within the authenticated admin session, potentially leading to significant harm to the website integrity and data confidentiality.

References