CVE-2026-92144 describes a stored cross-site scripting vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder WordPress plugin. The flaw exists due to insufficient input sanitization and output escaping of the 'postdata-1[post-custom]' parameter in all versions up to and including 1.57.2. An unauthenticated attacker can exploit this by obtaining a form submission nonce from the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint, enabling injection of arbitrary web scripts that execute when users view the injected content.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary JavaScript in the context of users visiting the affected pages, potentially leading to session hijacking, defacement, or other malicious actions impacting confidentiality and integrity. The vulnerability does not affect availability. The CVSS 3.1 base score is 7.2 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity with scope changed.

No official patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider disabling or restricting access to the vulnerable plugin or its endpoints to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.