Stored Cross-Site Scripting Vulnerability in Forminator Forms Plugin for WordPress

CVE-2026-92144

What is CVE-2026-92144?

The Forminator Forms plugin for WordPress suffers from a stored cross-site scripting vulnerability through the 'postdata-1[post-custom]' parameter. This flaw arises from inadequate input sanitization and output escaping, enabling unauthenticated attackers to insert arbitrary web scripts into pages. Upon accessing an affected page, users trigger the execution of these scripts, risking sensitive information exposure and account compromise. The attack can be fully executed without user authentication due to the ability to obtain the required form submission nonce from the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint. Consequently, all users visiting the manipulated pages are at risk.

References