Forminator and Forminator Pro < 1.27.0 - Admin+ Stored Cross-Site Scripting
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.5%
exploitation probability
0.5%top 63% of all CVEs
observed exploitation
nono source reports it
The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfiltered_html capability is disallowed (for example in a multisite setup).
Affected products
Unknown · Forminator