Forminator Forms, a WordPress plugin, contains a DOM‑based reflected XSS flaw that can be exercised through the error_description query parameter. An unauthenticated attacker can inject malicious JavaScript that will execute in the context of any user who views a page containing the affected form, potentially compromising confidential data or carrying out phishing or other malicious actions. The weakness involves insufficient input sanitization and output escaping, and maps to CWE‑79.

The vulnerability affects the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin provided by WPMU DEV, in all releases up to and including 1.57.0. Any WordPress site running this exact or earlier version and that uses the Stripe Checkout Sessions payment API (the default since 1.56.0) is exposed.

The CVSS base score of 7.2 indicates a high risk level. No EPSS data is publicly available, but the flaw is only triggerable on forms using Stripe Checkout Sessions, limiting the attack surface. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. An attacker can craft a URL with a malicious error_description payload and cause arbitrary script execution in users’ browsers. Because authentication is not required, the risk remains significant for any hosted site using the affected plugin.