Because the vulnerability is unauthenticated, an external actor can craft a payload containing arbitrary JavaScript and submit it via a public-facing form that utilizes a Rich-Text Textarea field. The payload is stored on the server and executes in the browser of any user (such as an administrator or other site visitor) who views the page containing the rendered input. This poses a significant risk for session hijacking, unauthorized actions performed on behalf of legitimate users, and potential defacement of the WordPress site. Organizations using this plugin should verify if the Rich-Text editor is enabled on any publicly accessible forms and restrict access or patch immediately to version 1.57.0.2 or later.

Impact

The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript within the context of a victim's session. In WordPress environments, this typically leads to the theft of administrative session cookies, unauthorized modification of site content, creation of new administrative accounts, or redirection of users to malicious infrastructure. The exploitability is limited to forms where the specific Rich-Text editor component is actively configured.

Recommendation

• Update the Forminator Forms plugin to version 1.57.0.2 or later immediately to patch CVE-2026-18324.
• Audit existing WordPress forms to identify and disable the Rich-Text editor option on public-facing Textarea fields until patching is complete.
• Monitor web application firewall (WAF) logs for POST requests containing script tags or event handlers directed at endpoints used by the Forminator plugin.