CVE-2026-18324

Name of the Vulnerable Software and Affected Versions Forminator Forms – Contact Form, Payment Form & Custom Form Builder versions prior to 1.57.0.2

Description Insufficient input sanitization and output escaping in the Rich-Text Textarea Field allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. This allows the injection of arbitrary web scripts into pages that execute when a user accesses them. Exploitation is possible only if the targeted Textarea field has the Rich-Text editor option enabled.

Recommendations Update Forminator Forms – Contact Form, Payment Form & Custom Form Builder to version 1.57.0.2 or later. As a temporary mitigation, disable the Rich-Text editor option for all Textarea fields.