CVE-2026-92144

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92144 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92144

The Forminator Forms plugin for WordPress (all versions up to and including 1.57.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping related to the 'postdata-1[post-custom]' parameter. This allows unauthenticated attackers...

EUVD-2026-90595

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92144 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92144: Improper Neutralization of Input During Web Page Generation

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-103770

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postdata-1post-custom' Parameter in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it...