CVE-2026-85235 Overview
CVE-2026-85235 is a Stored Cross-Site Scripting (XSS) vulnerability in the Forminator Forms plugin for WordPress. The flaw affects all versions up to and including 1.57.2 of the Contact Form, Payment Form & Custom Form Builder plugin. The root cause is insufficient input sanitization and output escaping in the Rich-Text Textarea field. Unauthenticated attackers can submit form entries containing crafted payloads that execute in an administrator's wp-admin session when the entry is reviewed. The issue is tracked as [CWE-79] and was addressed in Forminator release 1.57.2.1.
Critical Impact
An unauthenticated attacker can plant a payload in a form submission that fires JavaScript inside the authenticated session of any administrator who opens the stored entry in the Forminator Entries view.
Affected Products
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress
- All versions up to and including 1.57.2
- Fixed in version 1.57.2.1
Discovery Timeline
- 2026-10-01 - CVE-2026-85235 published to the National Vulnerability Database
- 2026-10-01 - Last updated in NVD database
Technical Details for CVE-2026-85235
Vulnerability Analysis
The vulnerability resides in how Forminator handles rich-text textarea submissions and renders them in the administrative Entries view. Unauthenticated users can submit a form containing a crafted hyperlink whose attributes carry an attacker payload. The stored content survives the submission pipeline without sufficient sanitization or output escaping. When an administrator opens the submission in admin/views/custom-form/entries/content-details.php, the payload is rendered in the wp-admin page context. WordPress core's jQuery click handler bound to .contextual-help-tabs a evaluates the entity-decoded href attribute as HTML, which triggers execution of attacker-controlled script inside the administrator's authenticated session.
Root Cause
The underlying weakness is improper neutralization of input during web page generation [CWE-79]. The relevant code paths in library/fields/textarea.php, library/abstracts/abstract-class-front-action.php, and library/helpers/helper-forms.php do not sufficiently filter rich-text content, and the entries view does not escape output to the context in which it is rendered. The combination allows a stored hyperlink to be interpreted as executable markup through the core jQuery handler.
Attack Vector
Exploitation requires only network access to a public Forminator form that includes a Rich-Text Textarea field. The attacker submits a crafted entry anonymously. Execution occurs when an authenticated administrator subsequently opens the stored submission in the Forminator Entries view and interacts with the planted link. Because the payload runs in the context of wp-admin, it inherits the administrator's privileges and can perform actions such as creating accounts, modifying content, or exfiltrating session data. Technical specifics are documented in the Wordfence Vulnerability Report and the WordPress Forminator Changeset 1.57.2.1.
Detection Methods for CVE-2026-85235
Indicators of Compromise
- Form submissions in the Forminator entries table containing HTML anchor tags with suspicious href values such as javascript: schemes or encoded script payloads.
- Unexpected creation of WordPress administrator accounts or modification of plugin and theme files following a form submission review.
- Outbound requests from browsers of logged-in administrators to attacker-controlled domains originating from wp-admin pages.
Detection Strategies
- Review stored Forminator entries for Rich-Text Textarea content that contains <a> elements with scripted attributes or HTML entity-encoded payloads.
- Inspect web server logs for POST requests to Forminator form endpoints that include encoded script fragments.
- Monitor WordPress audit logs for administrator actions that occur immediately after an entry review session.
Monitoring Recommendations
- Enable a WordPress activity log plugin to record administrator sessions, user creation events, and plugin or theme file edits.
- Deploy a web application firewall (WAF) rule set that inspects form submissions for XSS patterns targeting rich-text fields.
- Alert on new administrator-level user accounts and on changes to privileged user roles.
How to Mitigate CVE-2026-85235
Immediate Actions Required
- Update the Forminator Forms plugin to version 1.57.2.1 or later across all WordPress installations.
- Audit existing form entries submitted before patching for payloads in Rich-Text Textarea fields and purge suspicious submissions.
- Review administrator and editor accounts for unauthorized additions or role changes.
Patch Information
The vendor addressed the flaw in Forminator 1.57.2.1. The code changes are visible in the WordPress Forminator Changeset 1.57.2.1. Administrators should apply the update through the WordPress plugin management console or via WP-CLI.
Workarounds
- Disable the Rich-Text Textarea field on all public Forminator forms until the plugin is updated.
- Restrict access to the Forminator Entries view to a minimum number of administrators and avoid clicking links inside submitted entries.
- Deploy a WAF ruleset that blocks HTML and JavaScript patterns inside Forminator submission parameters.
# Update Forminator via WP-CLI
wp plugin update forminator --version=1.57.2.1
wp plugin list --name=forminator --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
