Live › vulnerability › CVE-2026-101335
Go to dashboardForminator Forms for WordPress, up to and including 1.58.1, runs attacker-supplied text from the User-Agent header and a referer POST parameter through WordPress shortcode processing on quiz notifications. An unauthenticated visitor can execute whatever shortcodes other installed plugins or themes register, which can mean content injection or information disclosure.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Forminator Forms plugin at version 1.58.1 or earlier that have quiz forms with notification templates containing the {quiz_result} merge tag. The impact depends on which shortcodes other plugins and themes on the same site register, so sites with few shortcodes face less risk. Sites without Forminator, or running a later version, can skip it.
No product ranges from the sources yet.
wp plugin get forminator --field=version{quiz_result}1.58.1; the exact fixed version is unknown from the sources{quiz_result} from quiz notification templates until updatedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 1.58.1. This is due to the forminator_replace_quiz_form_data() helper invoking do_shortcode() on the fully expanded notification body once the {quiz_result} merge tag has been substituted, while the earlier-substituted {user_agent} and {refer_url} merge tags carry unauthenticated attacker-controlled bytes (the User-Agent header and the referer_url POST parameter) through sanitize_text_field()/esc_html(), neither of which strip the '[' and ']' shortcode delimiters. This makes it possible for unauthenticated attackers to execute arbitrary WordPress shortcodes registered on the site by submitting a quiz whose notification template contains {quiz_result}; the resulting impact depends on the shortcodes exposed by other installed plugins/themes and can range from arbitrary content injection to information disclosure.
This page as .md · .json · in your agent: get_signal("CVE-2026-101335")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.