The Forminator Forms plugin for WordPress is vulnerable to stored DOM-based XSS through the 'id' and 'data-size' parameters in versions up to and including 1.44.1. Insufficient sanitization and escaping permits an authenticated user with Contributor or higher access to embed malicious scripts that are executed on any user viewing the affected page. This flaw falls under CWE-79.

WordPress sites running the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin from WPMUDEV, specifically any released version up to and including 1.44.1. Users must verify that their installation does not include these vulnerable versions.

The CVSS score of 6.4 indicates a moderate severity, while the EPSS score of less than 1% suggests low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog, further reducing immediate risk. Attackers require authenticated Contributor-level or higher access, and must submit malicious payloads via the vulnerable parameters, after which the script is stored and executed for subsequent visitors. Due to these constraints, the likely attack vector is internal exploitation by site contributors who can edit form content.