---
id: CVE-2026-92144
title: >-
  The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin
  for WordPress is vulnerable to Stored Cross-Site Scripting via
  'postdata-1[post-custom]' Parameter in all versions up to, and including,
  1.57.2 due to insuffi…
summary: >-
  The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin
  for WordPress is vulnerable to Stored Cross-Site Scripting via
  'postdata-1[post-custom]' Parameter in all versions up to, and including,
  1.57.2 due to insuffi…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: wpmudev
product: 'Forminator Forms – Contact Form, Payment Form & Custom Form Builder'
affected:
  - forminator_forms_contact_form_payment_form_custom_form_builder <= 1.57.2
published: '2026-10-01'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T10:17:17.370'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-92144'
references:
  - url: >-
      https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.2/library/abstracts/abstract-class-front-action.php#L127
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.2/library/abstracts/abstract-class-front-action.php#L973
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.2/library/class-core.php#L690
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.2/library/class-core.php#L756
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.2/library/fields/postdata.php#L1012
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.2/library/modules/custom-forms/front/front-action.php#L3528
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset/3700690/forminator/trunk/library/abstracts/abstract-class-front-action.php
    label: security@wordfence.com
  - url: >-
      https://plugins.trac.wordpress.org/changeset?reponame=&new=3700709%40forminator%2Ftags%2F1.57.2.1&old=3668424%40forminator%2Ftags%2F1.57.2
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f320d2-fd24-47b5-804d-31e3afdc31ba?source=cve
    label: security@wordfence.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-01T09:41:14.169Z'
---

## Overview

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form submission nonce is freely obtainable by unauthenticated users via the publicly accessible wp_ajax_nopriv_forminator_get_nonce endpoint, making the full attack chain exploitable without any authentication or prior account.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.