The Forminator plugin includes a flaw that allows unauthenticated attackers to embed malicious scripts via the title parameter. Unsanitized input is added directly to the page output, enabling the injection of arbitrary JavaScript. Attackers can leverage this by crafting a link or message that a victim clicks, at which point the malicious code executes in the victim’s browser, potentially leading to defacement, phishing, or session hijacking.

All instances of the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin released by WPMUDEV up to and including version 1.38.2 are impacted. Any WordPress site deploying these releases is susceptible to the reflected XSS flaw.

The CVSS score is 6.1 and the EPSS score indicates a very low exploitation probability (<1%). Attackers do not need authenticated access, but they must entice a user into clicking a crafted URL or link that supplies a malicious title value. The vulnerability is not listed in the CISA KEV catalog, so there are currently no large‑scale exploitation reports.