CVE-2026-18325: 
WordPress vulnerability analysis and mitigation

CVE-2026-18325 is a Stored Cross-Site Scripting (XSS) vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress, affecting all versions up to and including 1.56.1. The flaw allows unauthenticated attackers to inject arbitrary web scripts via forged upload records through the Select Field, which persist and execute whenever any user accesses an affected page. It was published on August 6, 2026, with a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory).

The vulnerability (CWE-79) stems from two distinct code-level flaws in the Forminator plugin. First, Forminator_Core::sanitize_array() skips all input filtering for array keys prefixed with select-, bypassing sanitization for attacker-controlled data. Second, set_field_data() treats a submitted return member in form data as a trusted internal flag, enabling an unauthenticated attacker to forge and persist a complete upload field record with an arbitrary file_url value — with no sanitization or validation applied. The vulnerable code paths are present in abstract-class-front-action.php (L127), class-core.php (L616), class-form-entry-model.php (L1569), and front-action.php (L1091) (GitHub Advisory).

Successful exploitation allows an unauthenticated attacker to persistently inject arbitrary JavaScript into WordPress pages served to all site visitors and administrators. Because the scope is changed (S:C in CVSS), the injected scripts can affect resources beyond the vulnerable component itself, enabling session hijacking, credential theft, defacement, or redirection of users to malicious sites. Confidentiality and integrity are both impacted at a low level per CVSS, though chained attacks (e.g., admin session theft leading to full site takeover) could amplify the real-world impact (GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Forminator Forms plugin version ≤ 1.56.1 using tools like WPScan, Shodan, or by inspecting plugin metadata in publicly accessible readme.txt files.
2. Locate a target form: Find a publicly accessible page containing a Forminator form that includes both a Select Field and a File Upload field.
3. Craft a malicious POST request: Submit a form POST request where a field key is prefixed with select- (e.g., select-1) to bypass sanitize_array() filtering. Include a return member in the submitted data to trick set_field_data() into treating the submission as a trusted internal upload record.
4. Inject the XSS payload: Set the forged file_url value within the upload record to a JavaScript payload (e.g., javascript:alert(document.cookie) or an <img src=x onerror=...> tag), which will be stored without sanitization.
5. Trigger execution: The injected script executes automatically whenever any user (including administrators) visits the page or admin panel section where the form submission is rendered, enabling session hijacking or further exploitation (GitHub Advisory).

• Network: Unusual POST requests to Forminator form submission endpoints containing parameters with select- prefixed keys alongside a return field; requests originating from automated tools or unexpected geographic sources.
• Logs: WordPress access logs showing repeated form submissions with anomalous field names (e.g., select-*) and unexpected file_url values containing JavaScript or HTML tags.
• Database: Forminator form entry records in the WordPress database (wp_frmt_form_entry_meta or similar tables) containing file_url values with JavaScript payloads or unexpected external URLs rather than legitimate file paths.
• Browser/User Reports: Site visitors or administrators reporting unexpected pop-ups, redirects, or script execution when viewing pages containing Forminator form submissions.

Update the Forminator Forms plugin to a version newer than 1.56.1, which includes a patch addressing the sanitization bypass (changeset available at the WordPress plugin repository) (GitHub Advisory). As a temporary workaround, deploy Web Application Firewall (WAF) rules to detect and block form submissions containing select- prefixed parameters or forged return fields. Additionally, review existing form submission records in the database for entries with suspicious file_url values and remove any identified malicious entries.

The vulnerability was flagged by Wordfence's threat intelligence team, which published a dedicated advisory entry (GitHub Advisory). No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified at this time.