CVE-2026-85235

Name of the Vulnerable Software and Affected Versions Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.57.3

Description Insufficient input sanitization and output escaping in the Rich-Text Textarea Field allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs when an attacker injects arbitrary web scripts into a form submission. The payload executes when an administrator views the stored entry in the Forminator Entries view and interacts with a planted link, causing the WordPress core jQuery-based click handler on .contextual-help-tabs a to evaluate the entity-decoded href as HTML within the authenticated session.

Recommendations Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to version 1.57.3 or later.