{"id":"CVE-2026-116858","kind":"vulnerability","aliases":["CVE-2026-116858"],"related":[],"title":"WordPress Forminator plugin: stored XSS via unescaped HTML tags","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator forminator allows Code Injection.This issue affects Forminator: from n/a through 1.58.3.","summary":"Forminator, a WordPress form-builder plugin by WPMU DEV, fails to neutralize script-related HTML tags in some page output, enabling cross-site scripting. An attacker who can inject markup can run scripts in visitors' or admins' browsers.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["forminator","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Forminator version in the WordPress admin plugin list or with `wp plugin get forminator --field=version`","fix":"- Forminator: move to a version later than `1.58.3` (per the advisory's affected range)","status":"open","published_at":"2026-11-03T17:17:57+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","triaged_at":"2026-11-03T17:24:36+00:00","updated_at":"2026-11-03T17:24:36+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-03T17:24:36Z","model":"claude-haiku-5-5","output":{"fix":"- Forminator: move to a version later than `1.58.3` (per the advisory's affected range)\n- unknown","reach":"internet","title":"WordPress Forminator plugin: stored XSS via unescaped HTML tags","impact":"medium","summary":"Forminator, a WordPress form-builder plugin by WPMU DEV, fails to neutralize script-related HTML tags in some page output, enabling cross-site scripting. An attacker who can inject markup can run scripts in visitors' or admins' browsers.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","forminator","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitor or admin browsers on the site","analyst_note":"Confirm the fixed Forminator version and the exact vulnerable input from the NVD entry or the WPMU DEV changelog.","how_to_check":"- Check the installed Forminator version in the WordPress admin plugin list or with `wp plugin get forminator --field=version`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Forminator WordPress plugin at version 1.58.3 or earlier are in the stated range. The sources do not say which input or role is needed to trigger it, so treat any site with Forminator forms as potentially exposed.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000683,"input_tokens":4124,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116858':12A,15A '-2026':11A,14A '1.58.3':92C 'admin':61B 'affect':87C 'allow':83C 'attack':50B 'basic':75C 'browser':62B 'builder':27B 'code':84C 'cross':46B 'cross-sit':45B 'cve':10A,13A 'dev':31B,80C 'enabl':44B 'fail':32B 'form':26B 'form-build':25B 'formin':2A,16B,22B,81C,82C,88C 'host':20B 'html':8A,38B,69C 'improp':63C 'inject':53B 'injection.this':85C 'issu':86C 'markup':54B 'n/a':90C 'neutral':34B,64C 'output':43B 'packag':17B 'page':42B,74C 'plugin':3A,28B 'relat':37B,68C 'run':56B 'script':36B,48B,57B,67C 'script-rel':35B,66C 'self':19B 'self-host':18B 'site':47B 'store':4A 'tag':9A,39B,70C 'unescap':7A 'via':6A 'visitor':59B 'vulner':77C 'web':73C 'wordpress':1A,21B,24B 'wpmu':30B,79C 'xss':5A,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Forminator WordPress plugin at version 1.58.3 or earlier are in the stated range. The sources do not say which input or role is needed to trigger it, so treat any site with Forminator forms as potentially exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["forminator","medium","package","selfhosted","wordpress"],"first_public_at":"2026-11-03T17:17:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116858","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116858","severity":null,"published_at":"2026-11-03T17:17:57+00:00","modified_at":"2026-11-03T17:17:57+00:00","first_seen_at":"2026-11-03T17:21:55+00:00","fetched_at":"2026-11-03T17:21:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}