CVE-2026-85235 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

🗓️ 01 Oct 2026 08:28:42Reported by WordfenceType

Unauthenticated stored XSS in Forminator Forms via Rich-Text Textarea Field.

Reporter	Title	Published	Views	Family All 4
CVE	CVE-2026-85235	1 Oct 202608:28	–	cve
EUVD	EUVD-2026-90565	1 Oct 202608:28	–	euvd
NVD	CVE-2026-85235	1 Oct 202609:17	–	nvd
Patchstack	WordPress Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting vulnerability	1 Oct 202610:53	–	patchstack

[
  {
    "vendor": "wpmudev",
    "product": "Forminator Forms – Contact Form, Payment Form & Custom Form Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.57.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/forminator/tags/1.57.1/admin/views/custom-form/entries/content-details.php
plugins	www.plugins.trac.wordpress.org/browser/forminator/tags/1.57.1/library/fields/textarea.php
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/forminator/tags/1.57.1/library/abstracts/abstract-class-front-action.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/2ff3d390-ad00-4233-ab25-f1afb679300e
plugins	www.plugins.trac.wordpress.org/browser/forminator/tags/1.57.1/library/helpers/helper-forms.php

01 Oct 2026 08:28Current

CVSS 3.17.2

CWE-79