PT-2026-52436 · WordPress · Forminator

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-56071

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Forminator versions prior to 1.53.2

Description An unauthenticated cross-site scripting (XSS) flaw exists due to improper input validation and output encoding of user-supplied data. This allows a remote attacker to inject malicious scripts into pages where plugin output is rendered by submitting crafted payloads to exposed forms or endpoints without requiring an account. Successful exploitation can result in session hijacking, admin action forgery, and data theft.

Recommendations Update to version 1.53.2.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-56071

Affected Products

Forminator

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-56071 · Security Note
• https://twitter.com/UpwindMDR/status/2070200889525043240 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/forminator/vulnerability/wordpress-forminator-plugin-1-53-1-cross-site-scripting-xss-vulnerability?_s_id=cve · Note