The Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin suffers from a stored cross-site scripting vulnerability due to improper neutralization of input in the form_name parameter. This vulnerability allows authenticated users with high privileges to inject malicious scripts that persist and execute in the context of users viewing the injected content. The plugin's design permits administrators to delegate form management permissions to lower-level users, potentially broadening the scope of exploitation. The CVSS 3.1 vector indicates network attack vector, high attack complexity, high privileges required, no user interaction, and partial confidentiality and integrity impact.

An attacker with administrator-level access can inject persistent malicious scripts via the form_name parameter, which execute in the browsers of users who access the affected pages. This can lead to partial confidentiality and integrity compromise within the context of the affected site. The vulnerability could be exploited by lower-privileged users if granted form management permissions by administrators. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict form management permissions strictly to trusted administrators to prevent lower-privileged users from exploiting this vulnerability. Monitor for updates from the vendor regarding patches or official fixes.