WordPress Forminator plugin <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters vulnerability

Authenticated Contributor+ Stored DOM-Based Cross-Site Scripting via id and data-size Parameters vulnerability discovered by Asaf Mozes in WordPress Plugin Forminator versions = 1.44.1...

CVE-2025-5341 Forminator <= 1.44.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via id and data-size Parameters

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id' and 'data-size’ parameters in all versions up to, and including, 1.44.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-5341

CVE-2025-5341 affects the WordPress plugin Forminator Forms – Contact Form, Payment Form & Custom Form Builder. The vulnerability is a Stored Cross‑Site Scripting (XSS) caused by insufficient input sanitization and output escaping in the plugin’s handling of the id and data-size parameters, explo...