CVE-2026-18323: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

CVE-2026-18323 is a stored cross-site scripting vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin. The flaw exists in the handling of the radio field during the Save and Continue Draft process, where unauthenticated attackers can bypass validation due to the AJAX endpoint being registered as nopriv. This allows injection of arbitrary web scripts that execute on the Submissions admin page via the Inputmask library's data-attribute callback binding. The vulnerability affects all versions up to and including 1.57.0.2.

An unauthenticated attacker can inject persistent malicious scripts that execute in the context of users viewing the Submissions admin page. This can lead to information disclosure and limited integrity impact. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a scope change. There is no impact on availability.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Submissions admin page to trusted users only and consider disabling the Save and Continue Draft feature if feasible.