CVE-2026-102388
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Forminator by WPMU DEV through version 1.57.3 contains a Stored XSS vulnerability (improper input neutralization during web page generation). An attacker can store a malicious script that executes in the browser of every user visiting the infected page.
Risk Assessment
The risk includes persistent infection of the page, potentially leading to data theft, user account takeover, or malware distribution among visitors.
Recommendation
Update Forminator to a patched version and implement proper input validation and sanitization mechanisms to prevent stored XSS.
Other vulnerabilities in Forminator
See all- CVE-2026-56071High
Versions of Forminator up to 1.53.1 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
- CVE-2026-66583Critical
Unauthenticated PHP Object Injection vulnerability in Forminator versions up to 1.57.0. An attacker can send crafted data to execute arbitrary code.
- CVE-2026-108486Medium
Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.
- CVE-2026-65459High
The Forminator plugin in versions up to and including 1.57.3 allows an unauthenticated attacker to delete arbitrary content on a WordPress site. The flaw requires no login or special privileges.
- CVE-2026-96341High
The Forminator plugin by WPMU DEV versions up to 1.57.3 have an incorrect privilege assignment vulnerability that allows privilege escalation.
- CVE-2026-96336High
Authentication bypass by spoofing vulnerability in the Forminator plugin. Affects versions from n/a through 1.57.2.
- CVE-2026-106611High
The Forminator plugin (by WPMU DEV) up to version 1.57.3 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows an attacker to perform unauthorized actions on behalf of a logged-in user.
- CVE-2026-96335High
Missing Authorization vulnerability in WPMU DEV Forminator allows exploiting incorrectly configured access control security levels. Affects Forminator through 1.57.2.
- CVE-2026-82220Medium
The Forminator plugin in versions 1.57.1 and earlier contains an unauthenticated other vulnerability type. An attacker without authentication can exploit this flaw.
- CVE-2026-28143High
Unauthenticated Cross Site Scripting (XSS) in Forminator versions up to and including 1.56.0.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS