The Forminator Forms plugin allows an unauthenticated attacker to execute any WordPress shortcode on the site by crafting a quiz submission that includes the {quiz_result} merge tag in the notification template. The attack vector exploits the plugin’s forminator_replace_quiz_form_data() helper, which passes the user’s User-Agent header and the referer_url POST parameter through sanitize_text_field() and esc_html() before the final do_shortcode() call. These sanitizers do not strip the square‑bracket shortcode delimiters, enabling the attacker to inject arbitrary shortcodes that will be processed by WordPress. The resulting impact depends on which shortcodes are registered on the site and can range from content injection to information disclosure or further privilege escalation if malicious shortcodes exist in other plugins or themes.

All WordPress sites running the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin version 1.58.1 or earlier are impacted. The vulnerability is tied to the plugin’s quiz notification system; any site that uses the quiz feature with the {quiz_result} merge tag is at risk.

The CVSS score of 6.5 indicates a medium severity exploit in terms of confidentiality and availability risk. The EPSS score is not available, and this issue is not listed in the CISA KEV catalog, suggesting that while the vulnerability exists, its exploitation likelihood may be lower than other high‑profile flaws. The attacker only needs to submit a quiz form to trigger the vulnerability, providing no authentication or network restrictions. The availability of any arbitrary shortcode on the site determines the ultimate impact; therefore, sites with a large number of plugins that expose shortcodes are at especially higher risk.