CVE-2026-18328highCWE-79

CVE-2026-18328: high-severity vulnerability in wpmudev Forminator Forms – Contact Form…

Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter

Published

Follow this CVE+ Monitor Forminator Forms – Contact Form, Payment Form & Custom Form Builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.4%
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the 'error_description' parameter in all versions up to, and including, 1.57.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only triggerable on pages hosting a Forminator form configured to use the Stripe Checkout Sessions payment API, which became the default in 1.56.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Affected products
wpmudev · Forminator Forms – Contact Form, Payment Form & Custom Form Builder
Related CVEs — wpmudev Forminator Forms – Contact Form…

In the same product, most dangerous first.

CVE-2025-6463HIGHForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.44.2 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Form Submission DeletionEPSS 15.1%CVE-2023-4596CRITICALForminator <= 1.24.6 - Unauthenticated Arbitrary File UploadEPSS 14.3%CVE-2026-15748CRITICALForminator Forms <= 1.56.1 - Unauthenticated Arbitrary File Upload via Forged Upload Field ConfigurationEPSS 4.1%CVE-2023-6133MEDIUMForminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File UploadEPSS 0.9%CVE-2026-5192HIGHForminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'EPSS 0.8%CVE-2026-92229CRITICALForminator Forms <= 1.57.2 - Unauthenticated Arbitrary Shortcode Execution via 'current_url' ParameterEPSS 0.7%