WordPress Plugin Vulnerabilities

Forminator < 1.55.0.2 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
forminator
Fixed in 1.55.0.2

References

CVE
CVE-2026-57814
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c5697616-4e19-45a3-b860-623af66469bc

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
4fc35298-dc0c-4c33-89e1-b631f7231d59

Timeline

Publicly Published
2026-07-08 (about 3 months ago)
Added
2026-07-16 (about 3 months ago)
Last Updated
2026-07-16 (about 3 months ago)

Other

Published
Title
Published
2025-02-18
Title
Hostiko - Hosting WordPress & WHMCS Theme < 30.1 - Reflected Cross-Site Scripting
Published
2026-04-07
Title
AM LottiePlayer < 3.7.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
Published
2025-03-11
Title
Lava Ajax Search <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-09-22
Title
Library Bookshelves <= 5.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-06-12
Title
Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! < 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Horizontal Nav Menu Widge