The vulnerability is a stored cross‑site scripting flaw in the Forminator Forms plugin. An attacker can supply a crafted payload in the radio field when using the Save and Continue Draft AJAX endpoint. Because the endpoint is exposed to unauthenticated requests, the payload is persisted and later rendered on the Submissions admin page, where it is automatically executed through the Inputmask library’s data‑attribute callback binding. This allows the injection of arbitrary JavaScript that can compromise user sessions, deface content, or harvest sensitive data when a staff member views the submission details.

WordPress sites running the wpmudev:Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin, versions 1.57.0.2 and older. The plugin remains vulnerable up to and including 1.57.0.2; versions 1.57.0.3 and newer contain the fix.

The CVSS score of 7.2 indicates high severity, and the lack of a KEV listing suggests limited widespread exploitation but the EPSS score is not available, so the real-world attack probability is uncertain. The flaw is exploitable without authentication because the AJAX endpoint accepts anonymous traffic and bypasses radio field validation, so an attacker with internet access to the site can inject a payload and wait for an administrator to view the submission page. Once that occurs, the script runs with the context of the admin user, creating significant risk to confidentiality, integrity, and availability of the site.