The Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) via the 'limit' parameter. Authenticated attackers with Contributor or higher privileges can inject malicious scripts due to improper input neutralization and output escaping. This vulnerability affects all versions up to 1.42.0. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required. The vulnerability can lead to script execution in the context of users visiting the injected pages, potentially compromising confidentiality and integrity. No patch or official fix has been documented yet.

Successful exploitation allows an authenticated user with Contributor-level access or higher to inject and store malicious scripts that execute in the browsers of users who view the affected pages. This can lead to the disclosure of sensitive information and manipulation of content, impacting confidentiality and integrity. Availability is not affected. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or limiting use of the vulnerable 'limit' parameter in forms. Monitor vendor channels for updates and apply patches promptly once available.