CVE-2026-18324: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

CVE-2026-18324 is a stored cross-site scripting vulnerability (CWE-79) in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin. The issue arises from insufficient input sanitization and output escaping in the Rich-Text Textarea Field, enabling unauthenticated attackers to inject arbitrary web scripts. These scripts execute whenever a user views the injected page, potentially leading to information disclosure or session hijacking. The vulnerability affects all plugin versions up to and including 1.57.0.1. There is no vendor advisory or patch information currently available.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of the affected site, potentially leading to user session compromise or data theft. The CVSS score of 7.2 (high) reflects the network attack vector, low attack complexity, no privileges or user interaction required, and partial impact on confidentiality and integrity without availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling the Rich-Text editor option on Textarea fields or restricting access to forms that use this feature to trusted users only.