CVE-2026-85235 is a stored cross-site scripting vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin. The vulnerability arises from insufficient input sanitization and output escaping of the Rich-Text Textarea Field in versions up to 1.57.2. An unauthenticated attacker can inject arbitrary web scripts into stored form submissions. When an administrator opens the affected submission entry and interacts with a specific link, WordPress core's jQuery click handler evaluates the injected payload as HTML, leading to script execution within the administrator's authenticated session.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of an administrator's authenticated session in wp-admin. This can lead to partial confidentiality and integrity loss of the administrator's session and data. The vulnerability does not impact availability and requires administrator interaction with the malicious payload.

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is available, administrators should exercise caution when viewing Forminator Entries and avoid interacting with suspicious links in stored submissions.