{"id":"CVE-2026-115952","kind":"vulnerability","aliases":["CVE-2026-115952"],"related":[],"title":"Forminator WordPress plugin: stored XSS through form input, fixed after 1.58.3","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3.","summary":"Forminator, a WordPress form-builder plugin by WPMU DEV, fails to sanitize input before rendering it in pages, which makes it a stored cross-site scripting flaw. An attacker who can submit or enter data can run scripts in the browser of anyone who later views the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["forminator","package","self-hosted","wordpress"],"not_affected_if":["forminator-newer-than-1.58.3","forminator-not-installed"],"how_to_check":"- Check the installed Forminator version in the WordPress admin under Plugins, or in `wp-content/plugins/forminator/forminator.php`.\n- Confirm whether any form or page built with Forminator shows user-submitted content to other visitors or admins.","fix":"- Forminator versions up to and including `1.58.3` are affected; the sources do not name the fixed version.","status":"open","published_at":"2026-11-06T13:17:25+00:00","first_seen_at":"2026-11-06T13:42:19+00:00","triaged_at":"2026-11-06T13:43:16+00:00","updated_at":"2026-11-06T13:43:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T13:43:16Z","model":"claude-haiku-5-5","output":{"fix":"- Forminator versions up to and including `1.58.3` are affected; the sources do not name the fixed version.","reach":"internet","title":"Forminator WordPress plugin: stored XSS through form input, fixed after 1.58.3","impact":"medium","summary":"Forminator, a WordPress form-builder plugin by WPMU DEV, fails to sanitize input before rendering it in pages, which makes it a stored cross-site scripting flaw. An attacker who can submit or enter data can run scripts in the browser of anyone who later views the affected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","forminator","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' and admins' browsers on the site","analyst_note":"Confirm the fixed Forminator version and the exact trigger from the NVD entry or the WPMU DEV advisory.","how_to_check":"- Check the installed Forminator version in the WordPress admin under Plugins, or in `wp-content/plugins/forminator/forminator.php`.\n- Confirm whether any form or page built with Forminator shows user-submitted content to other visitors or admins.","plain_action":"","needs_analyst":true,"not_affected_if":["forminator-not-installed","forminator-newer-than-1.58.3"],"who_is_affected":"Sites running the Forminator WordPress plugin at version 1.58.3 or earlier are in scope. Exposure depends on whether submitted or stored form content is rendered to other visitors or administrators. Sites without Forminator can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000726,"input_tokens":4215,"output_tokens":609,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115952':14A,17A '-2026':13A,16A '1.58.3':11A,102C 'affect':73B,97C 'allow':93C 'anyon':68B 'attack':54B 'browser':66B 'builder':29B 'cross':49B,84C 'cross-sit':48B,83C 'cve':12A,15A 'data':60B 'dev':33B,90C 'enter':59B 'fail':34B 'fix':9A 'flaw':52B 'form':7A,28B 'form-build':27B 'formin':1A,18B,24B,91C,92C,98C 'generat':82C 'host':22B 'improp':75C 'input':8A,37B,78C 'issu':96C 'later':70B 'make':44B 'n/a':100C 'neutral':76C 'packag':19B 'page':42B,74B,81C 'plugin':3A,30B 'render':39B 'run':62B 'sanit':36B 'script':51B,63B,86C 'self':21B 'self-host':20B 'site':50B,85C 'store':4A,47B,94C 'submit':57B 'view':71B 'vulner':87C 'web':80C 'wordpress':2A,23B,26B 'wpmu':32B,89C 'xss':5A 'xss.this':95C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Forminator WordPress plugin at version 1.58.3 or earlier are in scope. Exposure depends on whether submitted or stored form content is rendered to other visitors or administrators. Sites without Forminator can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["forminator","medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-115952':14A,17A '-2026':13A,16A '1.58.3':11A 'cve':12A,15A 'fix':9A 'form':7A 'formin':1A 'input':8A 'plugin':3A 'store':4A 'wordpress':2A 'xss':5A","search_b":"'affect':73B 'anyon':68B 'attack':54B 'browser':66B 'builder':29B 'cross':49B 'cross-sit':48B 'data':60B 'dev':33B 'enter':59B 'fail':34B 'flaw':52B 'form':28B 'form-build':27B 'formin':18B,24B 'host':22B 'input':37B 'later':70B 'make':44B 'packag':19B 'page':42B,74B 'plugin':30B 'render':39B 'run':62B 'sanit':36B 'script':51B,63B 'self':21B 'self-host':20B 'site':50B 'store':47B 'submit':57B 'view':71B 'wordpress':23B,26B 'wpmu':32B","search_c":"'1.58.3':102C 'affect':97C 'allow':93C 'cross':84C 'cross-sit':83C 'dev':90C 'formin':91C,92C,98C 'generat':82C 'improp':75C 'input':78C 'issu':96C 'n/a':100C 'neutral':76C 'page':81C 'script':86C 'site':85C 'store':94C 'vulner':87C 'web':80C 'wpmu':89C 'xss.this':95C","first_public_at":"2026-11-06T13:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115952","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115952","severity":null,"published_at":"2026-11-06T13:17:25+00:00","modified_at":"2026-11-06T13:17:25+00:00","first_seen_at":"2026-11-06T13:42:19+00:00","fetched_at":"2026-11-06T13:42:19+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}