Live › vulnerability › CVE-2026-116858
Forminator, a WordPress form-builder plugin by WPMU DEV, fails to neutralize script-related HTML tags in some page output, enabling cross-site scripting. An attacker who can inject markup can run scripts in visitors' or admins' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 17:21 UTC. All times on this page are UTC.
Sites running the Forminator WordPress plugin at version 1.58.3 or earlier are in the stated range. The sources do not say which input or role is needed to trigger it, so treat any site with Forminator forms as potentially exposed.
No product ranges from the sources yet.
wp plugin get forminator --field=version1.58.3 (per the advisory's affected range)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code Injection.This issue affects Forminator: from n/a through 1.58.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-116858")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.