CVE-2026-18324: WordPress Forminator Plugin XSS Vulnerability

CVE-2026-18324 Overview

CVE-2026-18324 is a stored Cross-Site Scripting (XSS) vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress. The flaw affects all plugin versions up to and including 1.57.0.1 and is caused by insufficient input sanitization and output escaping in the Rich-Text Textarea field. Unauthenticated attackers can inject arbitrary web scripts that execute when any user views the affected page. Exploitation requires the targeted Textarea field to have the Rich-Text editor option enabled. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can persistently inject JavaScript into WordPress pages, enabling session theft, administrator account takeover, and site defacement across sites running vulnerable Forminator versions.

Affected Products

Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress
All versions up to and including 1.57.0.1
Only forms containing a Textarea field with the Rich-Text editor option enabled

Discovery Timeline

2026-08-28 - CVE CVE-2026-18324 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-18324

Vulnerability Analysis

The vulnerability resides in the Forminator plugin's handling of Rich-Text Textarea field submissions. When a form contains a Textarea field configured with the Rich-Text editor option, the plugin accepts HTML content from unauthenticated form submitters. The submitted content is stored in the database and rendered back to administrators and other users viewing form entries and generated pages without adequate sanitization or output escaping.

Because the injected payload is stored server-side, every subsequent page render triggers script execution in the victim's browser context. Administrators reviewing form entries in the WordPress dashboard are the highest-value targets, since script execution in an admin session enables full site takeover through plugin installation, user creation, or theme modification.

The attack scope is marked as changed, reflecting the ability of injected scripts to impact resources beyond the vulnerable component, such as authenticated admin sessions and other WordPress subsystems.

Root Cause

The plugin's textarea field handler (see textarea.php) and the admin entries rendering path (admin-page-entries.php, content-details.php) do not strip or escape dangerous HTML constructs when the Rich-Text editor option is enabled. Standard WordPress functions such as wp_kses_post() or context-appropriate escaping helpers like esc_html() and esc_attr() are not applied consistently across submission and rendering paths.

Attack Vector

An unauthenticated attacker locates a public Forminator form containing a Textarea field with Rich-Text enabled. The attacker submits a crafted payload containing HTML with embedded event handlers or script tags. The payload is stored in the WordPress database as part of the form entry. When an administrator or other user later views the entry in the admin dashboard or on any page that renders the field content, the browser executes the attacker-controlled JavaScript.

The vulnerability requires no authentication, no user interaction beyond normal viewing, and can be exploited remotely over the network. See the Wordfence Vulnerability Report for additional details.

Detection Methods for CVE-2026-18324

Indicators of Compromise

Form entries in the wp_frmt_form_entry_meta table containing <script>, <iframe>, onerror=, onload=, or javascript: sequences within Textarea submissions.
Unexpected outbound requests from administrator browsers to unfamiliar domains shortly after viewing Forminator form entries.
Newly created WordPress administrator accounts or plugin installations that correlate with admin sessions reviewing form submissions.
WAF or access log entries showing POST requests to /wp-admin/admin-ajax.php with action=forminator_submit_form carrying HTML markup in textarea parameters.

Detection Strategies

Audit stored form entries for HTML tags and JavaScript event handlers by querying Forminator entry meta tables for payload patterns.
Deploy a web application firewall rule that blocks or flags Forminator submissions containing script tags, iframe elements, or inline event handlers.
Review the Forminator plugin version reported in the WordPress plugins page and confirm it is greater than 1.57.0.1.
Correlate admin session activity with entry-viewing timestamps to identify potential exploitation of active admin browsers.

Monitoring Recommendations

Enable WordPress audit logging for administrator account creation, plugin installation, and role changes to catch post-exploitation actions.
Monitor the browser Content Security Policy (CSP) violation reports if CSP is deployed on the wp-admin interface.
Alert on any inline <script> content stored in database fields intended for user-generated text.

How to Mitigate CVE-2026-18324

Immediate Actions Required

Update the Forminator plugin to version 1.57.0.2 or later immediately across all WordPress installations.
Audit all existing form entries for stored payloads and purge malicious entries from the database.
Rotate administrator credentials and invalidate active WordPress sessions on any site where exploitation is suspected.
Review WordPress user lists for unauthorized administrator accounts created during the exposure window.

Patch Information

The vendor released a fix in Forminator 1.57.0.2. The relevant code changes are documented in Changeset 3652712 and the version diff from 1.57.0.1 to 1.57.0.2. The patch adds proper sanitization and escaping to the Rich-Text Textarea rendering paths.

Workarounds

Disable the Rich-Text editor option on all Textarea fields in Forminator forms until the plugin can be upgraded.
Temporarily deactivate the Forminator plugin if patching cannot be performed immediately and forms are non-critical.
Restrict access to /wp-admin/ by IP allowlist to limit exposure of administrator sessions to stored payloads.
Deploy a WAF rule that strips or blocks HTML tags in Forminator form submissions until patching is complete.

bash

# Update Forminator via WP-CLI to the patched release
wp plugin update forminator --version=1.57.0.2

# Verify the installed version
wp plugin get forminator --field=version

# Search stored entries for suspicious payloads
wp db query "SELECT meta_id, entry_id, meta_key FROM wp_frmt_form_entry_meta WHERE meta_value REGEXP '<script|onerror=|onload=|javascript:';"