CVE-2026-57814
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Forminator plugin for WordPress contains a DOM-based XSS vulnerability due to improper input neutralization during web page generation. The issue affects versions up to and including 1.55.0.1.
Risk Assessment
An attacker can inject a malicious client-side script, potentially leading to session hijacking, redirection to malicious sites, or theft of sensitive data.
Recommendation
Immediately update the Forminator plugin to the latest available version that includes a security fix.
Other vulnerabilities in Forminator
See all- CVE-2026-56071High
Versions of Forminator up to 1.53.1 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.
- CVE-2026-66583Critical
Unauthenticated PHP Object Injection vulnerability in Forminator versions up to 1.57.0. An attacker can send crafted data to execute arbitrary code.
- CVE-2026-82220Medium
The Forminator plugin in versions 1.57.1 and earlier contains an unauthenticated other vulnerability type. An attacker without authentication can exploit this flaw.
- CVE-2026-28143High
Unauthenticated Cross Site Scripting (XSS) in Forminator versions up to and including 1.56.0.
- CVE-2026-28111High
Contributor Privilege Escalation vulnerability in Forminator versions up to 1.56.0. A user with Contributor role can escalate their privileges.
- CVE-2026-57815High
The Forminator plugin for WordPress contains a path traversal vulnerability that allows an attacker to access files outside the restricted directory. The issue affects versions up to and including 1.55.0.2.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows DOM-Based XSS.This issue affects Forminator: from n/a through <= 1.55.0.1.