The vulnerability permits an unauthenticated attacker to forge a form upload record that contains an arbitrary file_url value. Because the plugin skips sanitization for keys prefixed with 'select-' and treats a submitted 'return' member as a trusted flag, the malicious value is stored and later rendered without escaping, resulting in stored cross‑site scripting that executes whenever any user views the affected page.

The defect affects the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress from all releases through 1.56.1. Users running any of those versions are vulnerable.

With a CVSS score of 7.2 and no known public exploitation (EPSS not available, KEV not listed), the risk remains moderate to high. The attack is unauthenticated; a simple HTTP request can inject the payload, and the stored data compromises any user who subsequently views the affected page. Because the flaw resides in data handling rather than authentication, the likelihood of exploitation, while unconstrained by login credentials, is still significant for sites that allow form submissions.