The Forminator WordPress plugin (versions ≤ 1.29.0) suffers from a stored cross-site scripting vulnerability (CWE-79) due to inadequate sanitization and escaping of uploaded file content, including 3gpp files. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users viewing the affected pages. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with a scope change. No patch or official fix information is currently available, and no exploits have been observed in the wild.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary web scripts in the context of users accessing the affected pages, potentially compromising user sessions, stealing sensitive information, or performing actions on behalf of the user. The vulnerability impacts confidentiality and integrity but not availability. The scope is changed, indicating that the vulnerability affects components beyond the initially vulnerable code.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling or restricting file uploads in Forminator forms or applying web application firewall (WAF) rules to detect and block malicious payloads in uploaded files. Monitor vendor channels for updates and apply patches promptly once released.