CVE-2026-18328: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin suffers from a DOM-Based Reflected Cross-Site Scripting vulnerability via the 'error_description' parameter. This flaw exists in all versions up to and including 1.57.0 due to inadequate sanitization and escaping of user input. The vulnerability is specifically triggerable on pages with a Forminator form using the Stripe Checkout Sessions payment API, introduced as the default in version 1.56.0. An attacker can inject malicious scripts that execute in the context of the victim's browser when they visit the manipulated page.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of users visiting the affected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect availability and requires no user interaction beyond visiting the maliciously crafted page.

No official patch or remediation level has been confirmed as of the published date. Users should monitor the vendor's advisory channels for updates. Until a fix is available, avoid using the Stripe Checkout Sessions payment API feature in Forminator forms or disable the plugin if possible. Implementing web application firewall (WAF) rules to block suspicious input in the 'error_description' parameter may provide temporary mitigation.