The Forminator Forms plugin allows an authenticated user with at least Contributor level to configure form settings that are persisted in the database. Due to insufficient sanitization and escaping of the 'limit' parameter, these settings can include arbitrary scripts that are later rendered in page content. Consequently, when any visitor loads a page that reflects this configuration, the malicious script executes in that visitor’s browser. The vulnerability is a stored XSS flaw identified as CWE‑79 and can be used to steal session data or deface pages for users who view the affected form pages.

WordPress sites that have installed the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin and are running any version up to and including 1.42.0.

The CVSS score of 6.4 indicates a medium severity, while an EPSS score of <1% signals a very low probability of exploitation. Because the flaw requires a Contributor or higher authenticated user, attackers must first gain or abuse legitimate account privileges. The stored nature of the issue allows the injected script to persist until the configuration is reset or the plugin is updated. Since the vulnerability is not listed in CISA’s KEV catalog, no active exploits are documented at this time, yet the potential ability for an attacker to inject persistent JavaScript remains a significant risk for any user who views the affected form pages.