CVE-2026-18323 Overview
CVE-2026-18323 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Forminator Forms WordPress plugin. The flaw affects all versions up to and including 1.57.0.2. Unauthenticated attackers can inject arbitrary JavaScript through the Radio Field in the Save-and-Continue draft submission workflow. The injected payload executes when an administrator views the affected entry on the Submissions admin page. The vulnerability is rooted in insufficient input sanitization and output escaping combined with a nopriv AJAX endpoint that skips option-membership validation.
Critical Impact
Unauthenticated attackers can persist JavaScript that auto-executes in the WordPress admin context, enabling session theft, account takeover, and administrative action forgery.
Affected Products
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress
- All versions up to and including 1.57.0.2
- Fixed in version 1.57.0.3
Discovery Timeline
- 2026-08-25 - CVE-2026-18323 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-18323
Vulnerability Analysis
The vulnerability resides in Forminator's Save-and-Continue draft submission handler. The AJAX endpoint is registered with wp_ajax_nopriv_, exposing it to unauthenticated requests. Attackers submit a crafted Radio Field value that bypasses server-side option-membership validation, so the plugin persists arbitrary attacker-controlled strings as the field's stored value.
When an administrator opens the entry in the Submissions admin view (admin/views/custom-form/entries/content-details.php), the stored value is rendered without proper output escaping. The bundled Inputmask JavaScript library binds callbacks from data-* attributes on rendered fields, causing the injected script to execute automatically in the administrator's browser session.
Root Cause
Two defects combine to produce the vulnerability. First, the draft-submission code path in library/modules/custom-forms/front/front-action.php and library/fields/radio.php fails to enforce that submitted radio values match the field's defined options. Second, the admin entry rendering in content-details.php outputs the stored value into HTML attributes without sufficient escaping, and Inputmask's data-attribute callback binding treats the payload as executable.
Attack Vector
An unauthenticated attacker sends a crafted POST request to the nopriv Save-and-Continue AJAX endpoint of a public Forminator form containing a Radio Field. The request substitutes a JavaScript payload for the expected radio option value. The draft is persisted, and the payload executes the next time an authenticated administrator views submissions in the WordPress admin panel.
No authentication or user interaction beyond routine admin activity is required to trigger execution. Additional technical detail is available in the Wordfence Vulnerability CVE Analysis and the Forminator Radio Field Implementation.
Detection Methods for CVE-2026-18323
Indicators of Compromise
- Forminator form entries containing <script>, javascript:, onerror=, or data-inputmask attributes with executable content in Radio Field values.
- Unauthenticated POST requests to admin-ajax.php with action parameters tied to Forminator's Save-and-Continue draft handler.
- Unexpected outbound requests or admin session activity originating from browsers of users who accessed the Forminator Submissions page.
- New administrator accounts or modified user roles following administrator visits to the Submissions view.
Detection Strategies
- Inspect the wp_frmt_form_entry_meta (and related) database tables for Radio Field values containing HTML tags or JavaScript event handlers.
- Review web server access logs for POST requests to /wp-admin/admin-ajax.php with Forminator draft-save actions from unauthenticated sources.
- Monitor WordPress admin sessions for anomalous XHR or fetch calls triggered while viewing Forminator entries.
Monitoring Recommendations
- Enable request logging for admin-ajax.php and alert on payloads containing script markup targeting Forminator actions.
- Deploy a web application firewall rule to block requests where Radio Field parameters contain HTML or JavaScript syntax.
- Audit installed WordPress plugin versions on a scheduled cadence to identify hosts running Forminator <= 1.57.0.2.
How to Mitigate CVE-2026-18323
Immediate Actions Required
- Update the Forminator plugin to version 1.57.0.3 or later on every WordPress instance.
- Audit all existing Forminator form entries for stored payloads and purge malicious drafts before administrators view them.
- Rotate WordPress administrator credentials and invalidate active sessions if suspicious entries are found.
- Review administrator account listings and recent role changes for signs of exploitation.
Patch Information
The vendor addressed the issue in Forminator 1.57.0.3. The fix hardens output escaping in admin/views/custom-form/entries/content-details.php and tightens server-side validation of Radio Field values in the draft-submission path. Review the Forminator Changeset 3652725 and the Forminator Changeset Comparison 1.57.0.2 to 1.57.0.3 for the exact code changes.
Workarounds
- Temporarily disable the Forminator plugin until the upgrade to 1.57.0.3 can be scheduled.
- Disable the Save-and-Continue draft feature on all public Forminator forms.
- Restrict access to /wp-admin/admin-ajax.php at the WAF layer for Forminator draft actions originating from unauthenticated sessions.
- Apply a Content Security Policy that blocks inline script execution in the WordPress admin interface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
