CVE-2026-18323

Name of the Vulnerable Software and Affected Versions Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.57.0.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue exists because the Save-and-Continue draft submission AJAX endpoint is registered as nopriv, enabling attackers to bypass radio field option-membership validation. This allows the persistence of a crafted payload that executes automatically via the bundled Inputmask library's data-attribute callback binding when the Submissions admin page is accessed.

Recommendations Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to version 1.57.0.3 or later.