CVE-2025-0470: 
WordPress vulnerability analysis and mitigation

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress was identified with a Reflected Cross-Site Scripting vulnerability (CVE-2025-0470) on January 30, 2025. This vulnerability affects all versions up to and including 1.38.2, and is tracked with a CVSS v3.1 base score of 6.1 (Medium) (NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and stems from insufficient input sanitization and output escaping in the title parameter. The vulnerability has been assigned a CVSS vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required (NVD).

If successfully exploited, this vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when users perform specific actions, such as clicking on a malicious link. The impact is considered moderate with potential for both information disclosure and integrity compromise (NVD).

The vulnerability requires user interaction for successful exploitation, as indicated by the UI:R component in the CVSS score. An attacker would need to trick a user into performing a specific action to execute the malicious script (NVD).