CVE-2026-18328 Overview
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress contains a DOM-Based Reflected Cross-Site Scripting vulnerability [CWE-79]. The flaw affects all versions up to and including 1.57.0 and stems from insufficient input sanitization and output escaping in the error_description parameter. Unauthenticated attackers can inject arbitrary JavaScript that executes when a victim visits a crafted URL. Exploitation requires the target page to host a Forminator form configured to use the Stripe Checkout Sessions payment API, which became the default in version 1.56.0.
Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session on pages hosting a Stripe Checkout Sessions Forminator form, enabling session theft, credential harvesting, and site defacement.
Affected Products
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress
- All versions from initial release through 1.57.0
- Deployments running the Stripe Checkout Sessions payment integration (default from 1.56.0 onward)
Discovery Timeline
- 2026-08-25 - CVE-2026-18328 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-18328
Vulnerability Analysis
The vulnerability is a DOM-Based Reflected Cross-Site Scripting flaw in the client-side Stripe integration script front.stripe.js bundled with the Forminator plugin. The script consumes the error_description parameter and writes it into the DOM without escaping HTML metacharacters or filtering active script content. When a user visits a URL containing an attacker-controlled error_description value, the payload renders and executes within the origin of the WordPress site.
Because the sink resides in client-side JavaScript, the malicious content never reaches the server in a form that WAFs typically inspect, and traditional server-side output escaping does not mitigate the flaw. The vulnerability requires no authentication and no user interaction beyond visiting the crafted link. Successful exploitation lets attackers execute arbitrary scripts under the site's origin, enabling session cookie theft, phishing overlays on legitimate pages, and manipulation of payment flows.
Root Cause
The root cause is unsafe handling of the error_description query parameter inside the Stripe Checkout Sessions client logic. Multiple sinks in front.stripe.js (referenced around lines 196, 468, 543, and 1539 in tag 1.56.0) read the parameter and insert it into DOM nodes without sanitization. See the WordPress Forminator plugin source at line 1539 for the affected code path.
Attack Vector
An attacker crafts a URL to a vulnerable page containing a payload in the error_description parameter and distributes it through phishing, malicious ads, or forum posts. When any visitor loads the URL, the plugin's Stripe script reflects the payload into the DOM and the browser executes it. The vulnerability is only reachable on pages that render a Forminator form configured with Stripe Checkout Sessions.
The vulnerability mechanism is documented in the Wordfence advisory for CVE-2026-18328 and the patch changeset 3652645.
Detection Methods for CVE-2026-18328
Indicators of Compromise
- HTTP requests to pages hosting Forminator forms with an error_description query parameter containing HTML tags, javascript: URIs, or event handlers such as onerror= and onload=.
- Referer chains showing users arriving from external domains carrying encoded script payloads in the URL.
- Browser console errors or unexpected outbound requests from pages that embed Forminator Stripe Checkout forms.
Detection Strategies
- Inspect web server access logs for query strings containing error_description= combined with URL-encoded characters like %3Cscript, %3Cimg, or %22onerror.
- Deploy a Content Security Policy in report-only mode and monitor script-src violations originating on pages that render Forminator forms.
- Enumerate installed WordPress plugins across the estate and flag any Forminator instance at version 1.57.0 or earlier.
Monitoring Recommendations
- Track outbound requests from Forminator-hosting pages to unfamiliar domains that may indicate cookie exfiltration.
- Alert on WordPress administrator sessions that authenticate from new geographies shortly after users click external links.
- Continuously monitor plugin inventories and match against the WordPress vulnerability feed to catch regressions.
How to Mitigate CVE-2026-18328
Immediate Actions Required
- Update the Forminator Forms plugin to version 1.57.0.1 or later on every WordPress site in the environment.
- Audit all pages that embed Forminator forms and confirm which use the Stripe Checkout Sessions payment API introduced as the default in 1.56.0.
- Invalidate active administrator and customer sessions after patching to eliminate cookies potentially stolen through prior exploitation.
Patch Information
The vendor released the fix in Forminator 1.57.0.1. The corrective code changes are visible in the diff between tags 1.57.0 and 1.57.0.1 and in changeset 3652645, which adds sanitization to the error_description parameter handling in front.stripe.js.
Workarounds
- Temporarily disable the Forminator plugin on sites that cannot be patched immediately.
- Switch affected forms away from Stripe Checkout Sessions to a payment integration that does not exercise the vulnerable code path until the update is applied.
- Enforce a strict Content Security Policy with script-src 'self' and no unsafe-inline to blunt reflected script execution.
- Configure a web application firewall rule to strip or reject requests containing HTML metacharacters in the error_description query parameter.
# Example WAF rule (ModSecurity) to block script payloads in error_description
SecRule ARGS:error_description "@rx (?i)(<script|javascript:|onerror=|onload=)" \
"id:1802601,phase:2,deny,status:403,msg:'CVE-2026-18328 Forminator XSS attempt'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
