The Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin suffers from a DOM-based reflected XSS vulnerability via the 'error_description' parameter. This occurs due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of this parameter. The vulnerability is exploitable only on pages with a Forminator form configured to use the Stripe Checkout Sessions payment API, introduced as the default in version 1.56.0. All versions up to and including 1.57.0 are affected. The CVSS 3.1 base score is 7.2 (high severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity with no availability impact. No official patch or remediation guidance is currently provided.

An unauthenticated attacker can inject arbitrary web scripts via the 'error_description' parameter on pages hosting a Forminator form using Stripe Checkout Sessions. This can lead to execution of malicious scripts in the context of the victim's browser, potentially compromising confidentiality and integrity of user data. There is no reported impact on availability. The vulnerability requires no privileges or user interaction to exploit but is limited to pages configured with the Stripe Checkout Sessions payment API.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or avoiding the use of the Stripe Checkout Sessions payment API configuration in Forminator forms to reduce exposure. Monitoring vendor channels for updates is recommended.