CVE-2026-18325 is a stored cross-site scripting vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin. The vulnerability exists because Forminator_Core::sanitize_array() does not filter keys starting with 'select-', and set_field_data() treats the 'return' member as a trusted internal flag. This allows an unauthenticated attacker to forge and persist a complete upload field record with an arbitrary file_url value without sanitization or validation. Consequently, malicious scripts can be injected and executed in the context of users viewing the affected pages. The vulnerability affects all versions up to and including 1.56.1.

An unauthenticated attacker can exploit this vulnerability to inject and store malicious scripts in the plugin's upload field records. These scripts execute in the browsers of users who access the affected pages, potentially leading to information disclosure and limited integrity impact. There is no direct impact on availability. The CVSS 3.1 score is 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity with scope changed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the affected plugin or restricting access to pages using Forminator Forms to trusted users only. Monitor vendor channels for updates and apply official patches promptly once released.