CVE-2025-0469: Forminator Forms Plugin XSS Vulnerability

CVE-2025-0469 Overview

CVE-2025-0469 is a Stored Cross-Site Scripting (XSS) vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress. The flaw affects all versions up to and including 1.39.2. It stems from insufficient input sanitization and output escaping in the slider template data. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts that execute when a user views an affected page. The issue is tracked under CWE-79.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in the browser of any visitor to the affected page, enabling session hijacking, redirection, and administrative account takeover through victim interaction.

Affected Products

WPMU DEV Forminator Forms plugin for WordPress (free edition)
All versions up to and including 1.39.2
WordPress sites permitting Contributor-level user registration or authoring

Discovery Timeline

2025-02-27 - CVE-2025-0469 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-0469

Vulnerability Analysis

The vulnerability resides in how the Forminator plugin processes slider template data submitted through the form builder interface. The plugin fails to sanitize user-controlled input on the server side and fails to escape the same data when rendering it in the browser. As a result, attacker-supplied HTML and JavaScript persist in the WordPress database and execute in the Document Object Model (DOM) of any page that loads the affected form.

Because the vulnerable input path is exposed to users at Contributor level and above, exploitation does not require administrative privileges. The scope change reflected in the CVSS vector indicates the injected script executes outside the vulnerable component's security boundary, allowing action within the browsing user's WordPress session context. Successful exploitation requires the victim to load a page containing the injected payload.

The EPSS probability is 0.253% (percentile 15.16), indicating low observed exploitation likelihood in the near term. No public proof-of-concept or in-the-wild exploitation has been reported.

Root Cause

The root cause is missing input sanitization on slider template fields combined with missing output escaping in the front-end rendering path. The vulnerable rendering behavior can be observed in the plugin's forminator-form.js asset. See the WordPress Forminator JS File for the relevant code path.

Attack Vector

An authenticated user with Contributor privileges creates or edits a form that uses the slider component and embeds a JavaScript payload within the slider template data. The plugin stores the payload without sanitization. When any subsequent visitor, including administrators, loads a page that renders the form, the browser executes the injected script under the site's origin. This enables cookie theft, forced administrative actions through the WordPress REST API, and redirection to attacker-controlled infrastructure.

See the Wordfence Vulnerability Report for the vendor-verified technical description. No verified public exploit code is available at the time of writing.

Detection Methods for CVE-2025-0469

Indicators of Compromise

Unexpected <script>, <img onerror=>, or javascript: strings stored in the wp_postmeta or Forminator form configuration tables
Outbound requests from visitor browsers to unfamiliar domains immediately after loading pages containing Forminator forms
New or modified forms authored by Contributor-level accounts that include slider fields with unusual template data
Administrator session cookies replayed from unexpected IP addresses following form-page visits

Detection Strategies

Audit Forminator form definitions and slider template fields for HTML tags, event handlers, and encoded script payloads
Enable WordPress activity logging to correlate form creation and edit events with the responsible user account and role
Deploy a web application firewall rule that inspects POST bodies to admin-ajax.php and REST endpoints associated with Forminator for script tokens
Review browser Content Security Policy (CSP) violation reports for inline-script blocks originating on pages that render Forminator forms

Monitoring Recommendations

Alert on Contributor or Author accounts that gain the ability to create or modify forms outside their expected workflow
Monitor plugin file integrity and version metadata to confirm Forminator is running a patched release
Track anomalous DOM modifications and third-party script loads on public pages hosting Forminator forms

How to Mitigate CVE-2025-0469

Immediate Actions Required

Update the Forminator Forms plugin to a version later than 1.39.2 as soon as the vendor-provided fix is available
Review all existing forms, especially those using the slider component, and remove any embedded HTML or JavaScript from template data
Restrict Contributor-level and higher accounts to trusted users, and rotate credentials for any accounts suspected of misuse

Patch Information

The vulnerability affects all versions up to and including 1.39.2. Administrators should apply the latest Forminator release published by WPMU DEV through the WordPress plugin repository. Consult the Wordfence Vulnerability Report for the fixed version reference.

Workarounds

Disable the Forminator plugin on production sites until a patched version is installed
Remove the Contributor role's ability to create or edit Forminator forms through a role-management plugin
Enforce a strict Content Security Policy that blocks inline script execution on pages that render user-authored form content
Place the WordPress admin interface behind an IP allowlist to reduce the attack surface for authenticated exploitation

bash

# Configuration example
wp plugin update forminator
wp plugin status forminator