Executive brief
Forminator is a popular WordPress plugin used to create forms, polls, and quizzes. A security vulnerability in versions 1.53.1 and earlier allows unauthenticated attackers to inject malicious scripts into the website. If a site visitor or administrator interacts with a compromised page, the attacker could redirect users to malicious sites, steal session information, or display unauthorized advertisements, potentially damaging the site's reputation and user security.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the WPMU DEV Forminator plugin for WordPress in versions up to and including 1.53.1. The flaw is caused by improper neutralization of user-supplied input during web page generation (CWE-79). An unauthenticated remote attacker can exploit this by tricking a user into performing an action, such as clicking a crafted link or visiting a specific page, to execute malicious JavaScript in the context of the victim's browser. This can lead to session hijacking or unauthorized actions performed on behalf of a privileged user. The issue is resolved in version 1.53.2.
Affected products
- WPMU DEV Forminator <= 1.53.1
Timeline
- 2026-05-06: other: Vulnerability reported by researcher daroo
- 2026-06-24: patched: Fixed in version 1.53.2
- 2026-06-25: disclosed: CVE published to NVD