CVE-2026-57814: WPMU DEV Forminator DOM-based XSS

CVE-2026-57814 · Severity: high · CVSS 7.1 · Published 2026-07-13

Forminator, a popular WordPress plugin used for creating forms, polls, and quizzes, contains a security flaw that allows attackers to inject malicious scripts into the website. If a site administrator or visitor interacts with a specially crafted link or page, the attacker could execute code in their browser, potentially leading to unauthorized actions, data theft, or website defacement. This vulnerability is particularly dangerous as it can be used in automated campaigns targeting many websites simultaneously.

Technologies: WPMU DEV Forminator. Vendors: WPMU DEV.

Quick answers

Is CVE-2026-57814 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-57814 being exploited in the wild.
How severe is CVE-2026-57814?
High severity, with a CVSS score of 7.1, published 13 July 2026.
Which products and versions are affected?
WPMU DEV Forminator <= 1.55.0.1.
Is there a fix for CVE-2026-57814?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-57814 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-57814?
Check whether you run WPMU DEV Forminator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the WPMU DEV Forminator plugin for WordPress (versions <= 1.55.0.1). The flaw stems from improper neutralization of user-supplied input during web page generation, specifically within the DOM environment. An unauthenticated remote attacker can exploit this by tricking a user into performing an action, such as clicking a malicious link. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser session, which can lead to session hijacking or unauthorized administrative actions. The issue is resolved in version 1.55.0.2.

Affected products

  • WPMU DEV Forminator <= 1.55.0.1

Timeline

  • 2026-06-22: disclosed: Reported by daroo
  • 2026-07-08: advisory: Patchstack advisory published
  • 2026-07-13: advisory: NVD published date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.