CVE-2026-101335

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator replace quiz form data() helper invoking do shortcode() on the fully expanded notification body once the {quiz result} merge tag has been substituted, while the earlier-substituted {user agent} and {refer url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer url POST parameter) through sanitize text field()/esc html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.