An improper neutralization of input during web page generation allows stored cross‑site scripting in the Forminator plugin. Attackers can inject JavaScript that will be executed for any user who views the affected form. The impact includes cookie theft, session hijacking, defacement, and the potential to launch further client‑side attacks or phishing attempts by exploiting the victim’s browser context.

All WordPress installations using the WPMU DEV Forminator plugin up to and including version 1.57.3. The vulnerability affects the plugin itself, regardless of the WordPress core version.

The CVSS score of 7.1 indicates a high risk to confidentiality, integrity, and availability of affected users. Although the EPSS score is not available and the vulnerability is not currently listed in CISA's KEV catalog, the attack does not require privileged access; it can be triggered by any user who submits malicious content through the plugin’s forms. Once stored, the payload is served to all visitors, making the exploitation trivial for an attacker with the ability to craft input.