CVE-2026-92144 Overview
CVE-2026-92144 is a Stored Cross-Site Scripting (XSS) vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress. The flaw affects all versions up to and including 1.57.2. It stems from insufficient input sanitization and output escaping of the postdata-1[post-custom] parameter. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when any user accesses the injected page. The required form submission nonce is freely obtainable through the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint. This makes the full attack chain exploitable without authentication or any prior account access [CWE-79].
Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress pages, enabling session theft, administrative account hijacking, and site-wide client-side compromise.
Affected Products
- Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress
- All plugin versions up to and including 1.57.2
- Patched in version 1.57.2.1
Discovery Timeline
- 2026-10-01 - CVE-2026-92144 published to NVD
- 2026-10-01 - Last updated in NVD database
Technical Details for CVE-2026-92144
Vulnerability Analysis
The vulnerability resides in Forminator's postdata field handling. When a user submits a form containing a postdata field, the plugin accepts the postdata-1[post-custom] parameter and stores it against the generated WordPress post without applying proper sanitization. The stored value is later rendered without context-appropriate output escaping, resulting in persistent script execution in victim browsers.
Two code paths combine to make the issue exploitable by anonymous users. The wp_ajax_nopriv_forminator_get_nonce endpoint hands out valid submission nonces to unauthenticated requests. The front-action submission handler then accepts the attacker-controlled custom post data and processes it through the postdata field logic defined in library/fields/postdata.php and library/modules/custom-forms/front/front-action.php.
Because the payload is stored, every subsequent visitor to the generated post triggers the injected script in their session context.
Root Cause
The root cause is missing input sanitization on the postdata-1[post-custom] parameter and missing output escaping when the stored value is rendered. The plugin trusted the incoming custom post data array and persisted raw values. The fix shipped in changeset 3700690 and version 1.57.2.1 adds proper sanitization in abstract-class-front-action.php so malicious markup is stripped before storage.
Attack Vector
The attack is network-based, requires no authentication, and no user interaction to deliver the payload. An attacker performs three steps. First, request a nonce from wp_ajax_nopriv_forminator_get_nonce. Second, submit a crafted Forminator form containing an XSS payload inside the postdata-1[post-custom] field. Third, wait for an authenticated administrator or site visitor to view the resulting page, at which point the stored script executes with the victim's privileges.
The vulnerability manifests in the postdata field handler. See the Wordfence Vulnerability Report and the WordPress Forminator Post Data Function for technical details.
Detection Methods for CVE-2026-92144
Indicators of Compromise
- Unexpected <script> tags, event handlers, or javascript: URIs embedded in post content fields created through Forminator submissions.
- HTTP POST requests to admin-ajax.php with action=forminator_get_nonce from unauthenticated clients followed by form submissions containing encoded script payloads.
- Newly created WordPress posts or custom post types tied to Forminator form IDs that contain HTML markup the site does not normally accept from visitors.
- Browser console errors or outbound requests to unfamiliar domains originating when administrators view form-generated pages.
Detection Strategies
- Review the WordPress wp_posts table for post content inserted by Forminator that contains <script>, onerror=, onload=, or base64-encoded JavaScript patterns.
- Enable verbose web server access logging and search for sequences hitting wp_ajax_nopriv_forminator_get_nonce followed by forminator_submit_form within short time windows from the same IP.
- Deploy a Web Application Firewall (WAF) rule to inspect postdata-1[post-custom] parameter values for HTML and script content.
- Audit the installed Forminator plugin version via the WordPress admin or by inspecting wp-content/plugins/forminator/forminator.php for versions at or below 1.57.2.
Monitoring Recommendations
- Monitor file integrity for the Forminator plugin directory and alert on unexpected post content creation tied to form submissions.
- Correlate anonymous nonce retrieval with form submissions to identify automated exploitation attempts.
- Alert on administrator sessions issuing anomalous requests shortly after viewing Forminator-generated pages, which can indicate session hijacking via XSS.
How to Mitigate CVE-2026-92144
Immediate Actions Required
- Update the Forminator plugin to version 1.57.2.1 or later on every WordPress site in the environment.
- If immediate patching is not possible, disable or deactivate the Forminator plugin until the update is applied.
- Audit all posts and pages created through Forminator submissions since the plugin was installed and remove any containing injected scripts.
- Rotate administrator credentials and invalidate active sessions if evidence of exploitation is found.
Patch Information
The vendor released a fix in Forminator version 1.57.2.1. The patch adds sanitization in library/abstracts/abstract-class-front-action.php as documented in WordPress Forminator Changeset 3700690. The full diff between the vulnerable and patched release is available in the WordPress Forminator Changeset Comparison.
Workarounds
- Disable Forminator forms that use the postdata field type until the plugin is updated.
- Deploy a WAF rule that blocks requests containing HTML tags or JavaScript event handlers in any postdata-* parameter.
- Restrict access to admin-ajax.php endpoints with action=forminator_get_nonce from untrusted networks using edge or reverse proxy controls.
- Enforce a strict Content Security Policy (CSP) that forbids inline scripts on pages generated by Forminator submissions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
