# CVE-2026-115952: WPMU DEV Forminator stored cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-115952-improper-neutralization-of-input-during-web-page-generation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-115952 · Severity: medium · CVSS 6.5 · Published 2026-11-06

WPMU DEV Forminator is a form builder plugin for WordPress that allows website administrators and content creators to build contact and data collection forms. A stored cross-site scripting vulnerability allows a subscriber-level user to inject malicious scripts that will execute when other users view pages containing the affected form, potentially stealing visitor data or hijacking their accounts.

Technologies: [WPMU DEV Forminator](https://junglewise.ai/threats/technologies/forminator). Vendors: [WPMU DEV](https://junglewise.ai/threats/vendors/wpmu-dev).

## Quick answers

**Is CVE-2026-115952 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115952 being exploited in the wild.

**How severe is CVE-2026-115952?** Medium severity, with a CVSS score of 6.5, published 6 November 2026.

**Which products and versions are affected?** WPMU DEV Forminator through 1.58.3.

**Is there a fix for CVE-2026-115952?** Yes: fixed in 1.58.4. Until then: Patchstack has issued a mitigation rule to block attacks until you update to the patched version. As an immediate action, upgrade the plugin or contact your hosting provider or web developer for assistance. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115952 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-115952?** Check whether you run WPMU DEV Forminator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.58.4

Patchstack has issued a mitigation rule to block attacks until you update to the patched version. As an immediate action, upgrade the plugin or contact your hosting provider or web developer for assistance.

## Technical details

The vulnerability is a stored XSS flaw in WPMU DEV Forminator that allows improper neutralization of user input during web page generation. A subscriber-level attacker can inject malicious scripts that persist in the database and execute in the browsers of visitors viewing the affected form. The attack requires user interaction, as a privileged user must perform an action such as clicking a link or submitting a form.

## Affected products

- WPMU DEV Forminator through 1.58.3

## Timeline

- 2026-11-06: disclosed
- 2026-11-04: advisory: Patchstack advisory published

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-58-3-cross-site-scripting-xss-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-58-3-cross-site-scripting-xss-vulnerability?_s_id=cve)

## Related threats

- [WPMU DEV Forminator broken access control in form handling](https://junglewise.ai/threats/cve-2026-116859-missing-authorization-vulnerability-in-wpmu-dev-forminator)
- [WPMU DEV Forminator cross-site scripting in form content](https://junglewise.ai/threats/cve-2026-116858-improper-neutralization-of-script-related-html-tags-in-a-web)
- [WPMU DEV Forminator broken access control](https://junglewise.ai/threats/cve-2026-108486-missing-authorization-vulnerability-in-wpmu-dev-forminator)
- [WordPress Forminator arbitrary content deletion vulnerability](https://junglewise.ai/threats/cve-2026-65459-unauthenticated-arbitrary-content-deletion-in-forminator-1-57-3)
- [WPMU DEV Forminator privilege escalation](https://junglewise.ai/threats/cve-2026-96341-incorrect-privilege-assignment-vulnerability-in-wpmu-dev)