CVE-2026-18325 is a stored cross-site scripting vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin. Versions up to 1.56.1 are affected. The vulnerability is caused by Forminator_Core::sanitize_array() skipping filtering for keys prefixed with 'select-', and set_field_data() trusting a 'return' member as an internal flag without validation. This combination allows unauthenticated attackers to forge and persist upload field records with arbitrary file_url values without sanitization, enabling injection of malicious scripts that execute when users view the injected pages.

Successful exploitation allows unauthenticated attackers to inject and persist arbitrary web scripts in pages generated by the plugin. These scripts execute in the context of users visiting the affected pages, potentially leading to theft of user credentials, session hijacking, or other malicious actions. The vulnerability impacts confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or limiting use of the affected plugin versions. Monitor vendor channels for updates and apply patches promptly once released.