The vulnerability is an unauthenticated cross‑site scripting flaw in the Forminator plugin for WordPress, affecting all versions 1.53.1 and earlier. A malicious actor can inject arbitrary JavaScript into the plugin’s form rendering routine, which will execute in the browsers of anyone who views the affected page. This flaw aligns with CWE‑79.

The affected product is the WPMU DEV Forminator plugin for WordPress, with all releases up to and including 1.53.1 vulnerable. Users running these versions are at risk if they host or display the plugin’s forms.

The CVSS score of 7.1 indicates a medium‑to‑high severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is unauthenticated and relies on user‑visible rendering, any public or internal page that loads Forminator forms can be targeted. Successful exploitation would inject client‑side code that runs within the context of the viewing user's browser.