Stored Cross-Site Scripting in Forminator Forms Plugin for WordPress

The Forminator Forms - Contact Form, Payment Form & Custom Form Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to flaws in how the plugin handles input validation and field data persistence. The vulnerability exists in all versions up to and including 1.56.1. The root cause lies in the 'Forminator_Core::sanitize_array()' function, which fails to apply filtering to keys prefixed with 'select-', and the 'set_field_data()' function, which incorrectly treats a submitted 'return' member as a trusted internal flag. This combination allows an unauthenticated attacker to bypass security controls to forge and persist an upload field record containing malicious script payloads. When an administrative or authenticated user views the injected content, the payload executes within their browser context, potentially leading to session hijacking, unauthorized administrative actions, or further compromise of the WordPress environment.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's session. In a WordPress environment, this typically results in full administrative account takeover, unauthorized modification of site content, or the injection of additional malicious scripts across the platform. Given the popularity of the Forminator plugin, this vulnerability poses a significant risk to any site running versions 1.56.1 or earlier.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Update the Forminator Forms plugin to a patched version beyond 1.56.1 immediately to remediate the underlying sanitization flaw.
• Deploy web application firewall (WAF) rules to inspect POST requests to WordPress form endpoints, specifically looking for anomalous values in 'select-' prefixed keys or unexpected 'return' parameters.
• Audit web server access logs for repeated requests to form submission endpoints originating from unauthorized or suspicious IP addresses that attempt to inject common XSS payloads such as '<script>' tags or 'javascript:' pseudo-protocols.