CVE-2026-18323 is a stored cross-site scripting vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin. The flaw exists in the handling of the radio field Save and Continue Draft feature, where insufficient sanitization and escaping allow unauthenticated attackers to inject arbitrary scripts. The AJAX endpoint for saving drafts is registered as nopriv, permitting attackers to bypass option-membership validation and store crafted payloads. These payloads execute automatically on the Submissions admin page via the Inputmask library's data-attribute callback binding.

An unauthenticated attacker can inject and persist malicious scripts that execute in the context of an administrator viewing the submissions page. This can lead to partial compromise of confidentiality and integrity (e.g., theft of admin session data or manipulation of admin interface). Availability is not impacted. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and scope change.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the submissions admin page to trusted users only and monitor for suspicious activity. Avoid using the Save and Continue Draft feature if possible. Follow the vendor's official guidance once published.