The Forminator Forms plugin for WordPress contains a stored cross‑site scripting flaw in the form_name parameter, allowing authenticated administrators or users with form‑management rights to inject malicious scripts that persist in the database and execute whenever a page containing the form is viewed. The underlying weakness is insufficient input sanitization and output escaping (CWE‑79).

The vulnerability affects all installations of the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin up to and including version 1.50.2. WordPress sites running these versions, especially those that grant form‑management permissions to subscriber or lower‑level roles, are susceptible. Upgrading to version 1.50.3 or later removes the flaw.

The CVSS score is 4.4, indicating moderate risk, while the EPSS score is less than 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Attackers must have authenticated access, typically as administrators or privileged users with form‑management rights, and then submit a specially crafted form_name payload. Once stored, the script executes in the browser context of any visitor to the affected page.