CVE-2026-18325: Forminator WordPress Plugin XSS Vulnerability

CVE-2026-18325 Overview

CVE-2026-18325 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress. All versions up to and including 1.56.1 are affected. Unauthenticated attackers can forge a complete upload field record with an arbitrary file_url value. The injected script executes whenever a user accesses the affected page. The root cause is insufficient input sanitization and output escaping in Forminator_Core::sanitize_array() and set_field_data().

Critical Impact
Unauthenticated attackers can persist arbitrary JavaScript into WordPress pages, enabling session theft, administrative account takeover, and drive-by redirection of site visitors.

Affected Products

Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress
All versions up to and including 1.56.1
WordPress sites running vulnerable Forminator releases (branches 1.55.x and 1.56.0)

Discovery Timeline

2026-08-06 - CVE-2026-18325 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-18325

Vulnerability Analysis

The vulnerability exists in Forminator's form submission handling pipeline. The Forminator_Core::sanitize_array() function skips all filtering for array keys prefixed with select-. Attackers can pass arbitrary structured data through fields named with this prefix without any sanitization. This bypass allows an unauthenticated attacker to inject HTML and JavaScript payloads via select field submissions.

The stored payload is rendered without adequate output escaping, causing scripts to execute in the browser context of any user viewing the affected page. Because the vulnerability is exploitable over the network without authentication or user interaction, mass exploitation against publicly reachable WordPress installations is feasible.

Root Cause

Two compounding logic errors enable exploitation. First, Forminator_Core::sanitize_array() treats keys prefixed with select- as trusted and skips filtering. Second, set_field_data() treats a submitted return member as a trusted internal flag rather than untrusted user input. Together, these flaws allow an attacker to forge a complete upload field record, including an attacker-controlled file_url value, and persist it to the entry store without validation.

Attack Vector

An unauthenticated attacker crafts a Forminator form submission that includes a select- prefixed key containing a forged upload record structure. The record includes a return member and a malicious file_url containing JavaScript. The plugin stores the entry without sanitizing the forged fields. When an administrator or site visitor later loads a page that renders this stored data, the injected script executes.

See the Wordfence advisory for CVE-2026-18325 and the Forminator patch changeset 3628716 for technical details on the vulnerable code paths in class-core.php and front-action.php.

Detection Methods for CVE-2026-18325

Indicators of Compromise

Form submission POST bodies containing parameters prefixed with select- that carry nested arrays with file_url or return members.
Forminator form entries in the database with file_url values containing javascript:, <script, onerror=, or onload= substrings.
Unexpected outbound requests from administrator sessions loading Forminator entry views.
New administrator accounts or altered WordPress options created shortly after Forminator form submissions.

Detection Strategies

Inspect WordPress wp_frmt_form_entry_meta (or equivalent Forminator entry meta) rows for stored values containing HTML tags or JavaScript URI schemes.
Deploy a Web Application Firewall (WAF) rule that blocks POST requests to Forminator submission endpoints when parameter names begin with select- and contain nested file_url keys.
Correlate authenticated administrator page loads with immediate anomalous script execution or credential exfiltration attempts.

Monitoring Recommendations

Alert on any Forminator plugin version at or below 1.56.1 reported by WordPress site inventory scans.
Monitor administrator browser sessions for unexpected DOM modifications on pages that render Forminator entries.
Log and review all HTTP requests to admin-ajax.php and wp-json endpoints invoking Forminator submission handlers.

How to Mitigate CVE-2026-18325

Immediate Actions Required

Update the Forminator plugin to a version above 1.56.1 that includes the fix from changeset 3628716.
Audit existing Forminator form entries for stored payloads containing script tags, JavaScript URIs, or unexpected HTML in file_url fields.
Rotate WordPress administrator credentials if evidence of stored script execution is found.
Review WordPress user tables for unauthorized administrator accounts created since the plugin was first deployed.

Patch Information

Automattic released a patched version of Forminator that corrects both the sanitize_array() bypass and the trust assumption in set_field_data(). The fix is documented in WordPress Forminator changeset 3628716. Site administrators should apply the update through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Temporarily deactivate the Forminator plugin on public-facing WordPress sites until the patched version is installed.
Restrict form submission endpoints via a WAF rule that drops requests containing select- prefixed keys with nested array structures.
Remove or unpublish pages that display Forminator entry data to non-administrative users until the update is verified.

bash

# Update Forminator via WP-CLI to the patched release
wp plugin update forminator

# Verify the installed version is above 1.56.1
wp plugin get forminator --field=version

# Audit stored entries for suspicious file_url values
wp db query "SELECT meta_id, entry_id, meta_key, meta_value \
  FROM wp_frmt_form_entry_meta \
  WHERE meta_value LIKE '%<script%' \
     OR meta_value LIKE '%javascript:%' \
     OR meta_value LIKE '%onerror=%';"