CVE-2026-18328

Name of the Vulnerable Software and Affected Versions Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.58.0

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform DOM-Based Reflected Cross-Site Scripting. This occurs when arbitrary web scripts are injected into pages, which then execute upon user access. The issue is specifically triggerable on pages hosting a form configured to use the Stripe Checkout Sessions payment API via the error description parameter.

Recommendations Update to a version newer than 1.57.0. Avoid using the error description parameter in the Stripe Checkout Sessions payment API configuration until the update is applied.