{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/forminator-forms--1.56.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-18325"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Forminator Forms (\u003c= 1.56.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WPMU DEV"],"content_html":"\u003cp\u003eThe Forminator Forms - Contact Form, Payment Form \u0026amp; Custom Form Builder plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) due to flaws in how the plugin handles input validation and field data persistence. The vulnerability exists in all versions up to and including 1.56.1. The root cause lies in the 'Forminator_Core::sanitize_array()' function, which fails to apply filtering to keys prefixed with 'select-', and the 'set_field_data()' function, which incorrectly treats a submitted 'return' member as a trusted internal flag. This combination allows an unauthenticated attacker to bypass security controls to forge and persist an upload field record containing malicious script payloads. When an administrative or authenticated user views the injected content, the payload executes within their browser context, potentially leading to session hijacking, unauthorized administrative actions, or further compromise of the WordPress environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's session. In a WordPress environment, this typically results in full administrative account takeover, unauthorized modification of site content, or the injection of additional malicious scripts across the platform. Given the popularity of the Forminator plugin, this vulnerability poses a significant risk to any site running versions 1.56.1 or earlier.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Forminator Forms plugin to a patched version beyond 1.56.1 immediately to remediate the underlying sanitization flaw.\u003c/li\u003e\n\u003cli\u003eDeploy web application firewall (WAF) rules to inspect POST requests to WordPress form endpoints, specifically looking for anomalous values in 'select-' prefixed keys or unexpected 'return' parameters.\u003c/li\u003e\n\u003cli\u003eAudit web server access logs for repeated requests to form submission endpoints originating from unauthorized or suspicious IP addresses that attempt to inject common XSS payloads such as '\u0026lt;script\u0026gt;' tags or 'javascript:' pseudo-protocols.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-06T05:21:59Z","date_published":"2026-08-06T05:21:59Z","id":"https://feed.craftedsignal.io/briefs/2026-08-cve-2026-18325/","summary":"An unauthenticated stored XSS vulnerability in Forminator Forms plugin versions 1.56.1 and earlier allows attackers to inject and execute arbitrary web scripts via forged upload records.","title":"Stored Cross-Site Scripting in Forminator Forms Plugin for WordPress","url":"https://feed.craftedsignal.io/briefs/2026-08-cve-2026-18325/"}],"language":"en","title":"CraftedSignal Threat Feed - Forminator Forms (\u003c= 1.56.1)","version":"https://jsonfeed.org/version/1.1"}