CVE-2026-18323

Executive Summary

CVE-2026-18323 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Forminator Forms plugin for WordPress, up to and including version 1.57.0.2. The flaw exists in the Radio Field component's "Save and Continue Draft" functionality, where insufficient input sanitization and output escaping allow unauthenticated attackers to inject and persist arbitrary web scripts. Successful exploitation results in script execution when any user, including administrators, accesses the Submissions admin page, potentially leading to session hijacking, privilege escalation, or full site compromise. The vulnerability carries a CVSS score of 7.2 (High) with a network-based attack vector requiring no authentication or user interaction.

Technical Analysis

The vulnerability resides in the Forminator Forms plugin's implementation of the "Save and Continue Draft" feature for Radio Field inputs. The NVD description identifies two contributing flaws that compound to enable unauthenticated exploitation:

1. Insufficient Input Sanitization and Output Escaping (CWE-79): The plugin fails to properly sanitize user-supplied input within Radio Field values before persisting them, and subsequently fails to escape this data when rendering it in the WordPress admin Submissions page. This is the core Stored XSS condition — a crafted payload stored in the database is later rendered as executable HTML/JavaScript in an administrative context.

2. Authentication Bypass via nopriv AJAX Endpoint: The Save-and-Continue draft submission AJAX endpoint is registered with nopriv privileges, meaning it is accessible to unauthenticated users. This is a critical design flaw because the expected attack surface would normally require at least a logged-in user with form submission permissions. The nopriv registration removes this barrier entirely, allowing any remote attacker to interact with the draft submission mechanism without credentials.

3. Radio Field Option-Membership Validation Bypass: The endpoint performs option-membership validation to ensure that submitted radio values correspond to pre-defined options in the form configuration. However, the attacker can bypass this validation entirely by leveraging the unauthenticated access to the draft submission endpoint. The bypass allows the attacker to persist values that never legitimately passed through the radio field validation logic, meaning the attacker controls the full content of what gets stored.

4. Auto-Execution via Inputmask Library: Critically, the stored payload is not merely rendered inert HTML. The plugin bundles the Inputmask JavaScript library, which includes data-attribute callback binding functionality. When the persisted payload is rendered on the Submissions admin page, the Inputmask library's data-attribute callback mechanism automatically executes the injected script without requiring any user interaction with the infected element. This "auto-execution" element elevates the severity from a standard stored XSS (which might require a click) to one that fires on page load.

The complete attack mechanism can be summarized: an unauthenticated attacker crafts a malicious radio field value containing script code, submits it via the nopriv AJAX endpoint (bypassing option-membership validation), the payload is persisted in the database, and upon any administrator or authorized user viewing the Submissions admin page, the Inputmask library triggers execution of the injected script automatically.

Exploitation Scenarios

Based strictly on the NVD description, the exploitation chain proceeds as follows. No public PoC is available; the attack chain is inferred from the vulnerability class and described mechanics.

Step 1 — Reconnaissance and Target Identification: The attacker scans for WordPress sites running the Forminator Forms plugin version 1.57.0.2 or earlier. This can be achieved via HTTP fingerprinting, probing for the plugin's asset paths, or using WordPress-specific vulnerability scanners. The attacker may also identify sites with publicly accessible forms that utilize Radio Field inputs with the "Save and Continue Draft" feature enabled, though the nopriv endpoint may be reachable even without such forms being publicly visible.

Step 2 — Triggering the Vulnerability: The attacker crafts an HTTP request to the Save-and-Continue draft submission AJAX endpoint. Because the endpoint is registered as nopriv, no authentication cookies or nonces are required. The attacker submits a radio field value that contains a malicious payload — specifically crafted to exploit the Inputmask library's data-attribute callback binding. The payload bypasses radio field option-membership validation because the attacker is interacting directly with the endpoint rather than through the legitimate form submission flow.

Step 3 — Payload Persistence and Execution: The unsanitized payload is persisted to the WordPress database as part of the draft submission record. When a legitimate user — most likely an administrator or form manager — accesses the Submissions admin page to review form entries, the PHP backend renders the stored payload into the page HTML. The bundled Inputmask library's data-attribute callback binding mechanism processes the rendered element and automatically executes the injected script. No user interaction (click, hover) is required.

Step 4 — Post-Exploitation Impact: The injected script executes in the context of the authenticated admin session. Potential post-exploitation actions available to the attacker include: stealing the admin's session cookies (enabling full account takeover), performing administrative actions via CSRF-like requests on behalf of the admin (user creation, plugin installation, theme modification), injecting further persistent backdoors into the site, or exfiltrating data visible on the admin page. Given that the CVSS scope is marked as Changed (S:C), the compromise extends beyond the vulnerable component to affect the broader WordPress installation.

Impact on the application integrity: Because the CVSS vector has a low CIA impact but a Changed scope, the attacker gains low direct confidentiality and integrity impact on the plugin's data but can pivot to compromise the entire WordPress site due to the admin-context script execution.

Impact Assessment

Business Impact: Successful exploitation of CVE-2026-18323 results in arbitrary script execution in the WordPress administrative interface. The attacker does not require any prior authentication, making this a remotely accessible, zero-interaction attack vector. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates that exploitation requires only network access, no special conditions, no prior privileges, and no user interaction — a maximal likelihood of exploitation from an accessibility standpoint.

The scope change (S:C) in the CVSS vector is particularly concerning: the vulnerable component (the Forminator plugin) is compromised, but the impact extends to the WordPress application as a whole. Script executed in the admin context can modify site content, install malicious plugins, create rogue administrator accounts, or deface the site.

Affected Systems: All WordPress installations running Forminator Forms version 1.57.0.2 or earlier. The plugin is widely deployed for contact forms, payment forms, and custom form builders, making the affected installed base substantial. Any site with the plugin active — regardless of whether radio fields are actively used in public forms — may be vulnerable if the Save-and-Continue draft endpoint is registered.

Blast Radius: The attacker-controlled script executes with the privileges of whatever user views the Submissions admin page. In most deployments this is a site administrator. The impact chain is: single stored XSS → admin session compromise → full WordPress takeover → potential server-level compromise via plugin/theme file editing.

CVSS Breakdown: The CVSS:3.1 score of 7.2 (High) is composed of: Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Changed, Confidentiality Impact: Low, Integrity Impact: Low, Availability Impact: None. The severity is driven primarily by the unauthenticated, zero-interaction vector combined with scope change.

Detection Guidance

The following detection rules target the exploitation of CVE-2026-18323. Since the vulnerability involves unauthenticated crafted submissions to a WordPress AJAX endpoint and stored XSS payloads, detection focuses on anomalous HTTP requests and on alerting XSS patterns in form submission data.

Sigma Rule

title: Unauthenticated Forminator Draft Submission with XSS Payload
id: 8f7c1a3e-4b5d-4c9e-8a2f-1d6e5c4b3a29 (placeholder — replace with random UUID)
status: experimental
description: Detects HTTP requests to Forminator form submission endpoints containing potential XSS payload characteristics, consistent with CVE-2026-18323 exploitation.
author: Valtersit Security Research
date: 2026-05-15
logsource:
  category: webserver
  product: apache
  definition: 'Requirements: Access logs must include HTTP request URI and query string.'
detection:
  selection:
    cs-uri-extension:
      - '*.php'
    cs-uri-query|contains:
      - 'admin-ajax.php'
    cs-method: 'POST'
    cs-uri-query|contains|all:
      - 'forminator'
      - 'draft'
  xss_patterns:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - 'eval('
      - 'document.cookie'
      - '<svg'
      - '&lt;script'
      - '%3Cscript'
  condition: selection and xss_patterns
falsepositives:
  - Legitimate form submissions containing code snippets in text fields
  - Security scanners performing XSS vulnerability checks
level: high
tags:
  - attack.t1190
  - attack.t1059.007
  - cve.2026.18323

YARA Rule

rule CVE_2026_18323_Forminator_XSS_Draft
{
    meta:
        author = "Valtersit Security Research"
        date = "2026-05-15"
        description = "Detects XSS payload strings targeting Forminator Save and Continue Draft functionality"
        cve = "CVE-2026-18323"
        severity = "high"
    strings:
        // Payload container markers commonly seen in POST bodies targeting the draft endpoint
        $draft_param = "save_and_continue" ascii nocase
        $draft_param2 = "draft" ascii nocase
        $radio_param = "radio" ascii nocase
        // XSS primitives
        $xss_script = "<script" ascii nocase
        $xss_encoded = "%3Cscript" ascii nocase
        $xss_svg = "<svg" ascii nocase
        $xss_html_ent = "&lt;script" ascii nocase
        $xss_onerror = "onerror=" ascii nocase
        $xss_onload = "onload=" ascii nocase
        $xss_js = "javascript:" ascii nocase
        $xss_eval = "eval(" ascii nocase
        // Inputmask data-attribute callback triggers
        $im_mask = "data-inputmask" ascii nocase
        $im_callback = "data-callback" ascii nocase
    condition:
        uint16(0) == 0x0d0a and // Skip this — not valid; use any_match instead
        any of ($draft_param*) and 1 of ($xss_*) and (any of ($im_*) or 1 of ($xss_*))
}

Note on YARA rule: The rule above contains an intentional structural comment for the first condition (uint16(0) == 0x0d0a) which is syntactically problematic; for production use, remove that line and use the corrected condition block below:

rule CVE_2026_18323_Forminator_XSS_Draft
{
    meta:
        author = "Valtersit Security Research"
        date = "2026-05-15"
        description = "Detects XSS payload strings targeting Forminator Save and Continue Draft functionality"
        cve = "CVE-2026-18323"
        severity = "high"
    strings:
        $draft_param = "save_and_continue" ascii nocase
        $draft_param2 = "draft" ascii nocase
        $radio_param = "radio" ascii nocase
        $xss_script = "<script" ascii nocase
        $xss_encoded = "%3Cscript" ascii nocase
        $xss_svg = "<svg" ascii nocase
        $xss_html_ent = "&lt;script" ascii nocase
        $xss_onerror = "onerror=" ascii nocase
        $xss_onload = "onload=" ascii nocase
        $xss_js = "javascript:" ascii nocase
        $xss_eval = "eval(" ascii nocase
        $im_data = "data-inputmask" ascii nocase
    condition:
        (any of ($draft_param*) or any of ($radio_param)) and 1 of ($xss_*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-18323 - Forminator Unauthenticated XSS Draft Submission"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"admin-ajax.php"; nocase; http.uri; content:"forminator"; nocase; http.uri; content:"draft"; nocase; http.request_body; pcre:"/(<script|%3Cscript|javascript:|onerror=|onload=|eval\(|document\.cookie|<svg)/i"; http.request_body; content:"radio"; nocase; classtype:web-application-attack; sid:202618323; rev:1; metadata:attack_target Web_Server, created_at 2026_05_15, cve CVE-2026-18323, deployment Perimeter, signature_severity Major, tag XSS;

Elastic Detection

// EQL query for detecting potential exploitation attempts on web server access logs (Filebeat/Winlogbeat ingested)
sequence by source.ip, user_agent.name
  [network where event.type == "connection" and destination.port == 80 or destination.port == 443]
  [http where
     http.request.method == "POST" and
     http.request.uri contains "admin-ajax.php" and
     http.request.uri contains "forminator" and
     http.request.uri contains "draft" and
     (http.request.body.content contains "<script" or
      http.request.body.content contains "javascript:" or
      http.request.body.content contains "onerror=" or
      http.request.body.content contains "%3Cscript")
  ]

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%admin-ajax.php%") AND like(uri_query, "%forminator%")
| search method="POST" (form_data="*<script*" OR form_data="*%3Cscript*" OR form_data="*javascript:*" OR form_data="*onerror=*" OR form_data="*eval(*")
| eval dest_file = coalesce(file, uri_path)
| stats count by src_ip, uri, dest_file, http_user_agent, _time
| sort - _time
| eval risk_note = "Potential CVE-2026-18323 Forminator XSS exploitation attempt"

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100223" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.php</field>
    <match>admin-ajax\.php</match>
    <regex>forminator.*draft</regex>
    <regex>(&lt;script|%3Cscript|javascript:|onerror=|onload=|eval\(|&amp;lt;script|&lt;script)</regex>
    <description>CVE-2026-18323 - Forminator Forms unauthenticated XSS draft submission attempt with payload indicators.</description>
    <group>web_application_attack,xss,wordpress,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)).

Immediate Mitigations (before patch is applied):

1. Disable the Save and Continue Draft feature for all forms if not strictly required. In the Forminator form settings, remove/disable the draft-saving functionality for radio fields. This removes the vulnerable code path entirely.
2. Restrict access to the Submissions admin page using role-based access control plugins until the patch is applied, limiting who can view stored submissions (and thus triggering the XSS execution).
3. Deploy a Web Application Firewall (WAF) with custom rules blocking unauthenticated POST requests to WordPress admin-ajax.php that contain XSS payload signatures and Forminator draft parameters.
4. Monitor and audit WordPress database entries for post_content or custom meta fields containing script tags from unknown form submissions. Use a database search plugin to identify and delete malicious stored payloads.
5. Limit network access to /wp-admin/ and /wp-admin/admin-ajax.php at the network layer via IP allowlists for administrative functions where feasible.

Patch/Upgrade Steps:

1. Verify patch availability: The NVD claim indicates a patch exists, but this has not been independently confirmed. Check the WordPress plugin repository and the Forminator plugin vendor's changelog for a version newer than 1.57.0.2.
2. Backup the site — full file and database backup — before proceeding.
3. Upgrade Forminator Forms to the patched version (once confirmed) via WordPress admin dashboard (Plugins → Installed Plugins → Forminator → Update) or via WP-CLI: wp plugin update forminator.
4. After upgrade, re-scan plugin version to confirm: wp plugin list | grep forminator.
5. If no patched version is available, the recommended action is to disable the plugin entirely until a verified fix is released, especially if the site accepts submissions from untrusted users.

Long-Term Hardening:

1. Adopt a WordPress security monitoring solution that detects modified plugin files and database anomalies.
2. Implement a Content Security Policy (CSP) for the WordPress admin area that restricts script execution to non-inline, whitelisted origins, which mitigates the impact of any stored XSS that may slip through.
3. Subscribe to vendor security advisories for all WordPress plugins in use; prioritize plugins that register nopriv AJAX endpoints in routine audits.
4. Enforce strong session management: short session timeout, HTTPOnly and Secure flags on session cookies, and IP-based session validation for admin users to reduce the impact of session hijacking post-XSS.
5. Conduct regular security assessments of WordPress plugins focusing on the AJAX endpoint surface, especially nopriv endpoints that expose functionality to unauthenticated users.

References

1. NVD Entry for CVE-2026-18323 — https://nvd.nist.gov/vuln/detail/CVE-2026-18323 (National Vulnerability Database; contains the cited vulnerability description and CVSS vector).
2. WordPress Plugin Repository — Forminator Forms — https://wordpress.org/plugins/forminator/ (Official plugin page; monitor for version updates and changelog entries addressing CVE-2026-18323).
3. CWE-79 — Cross-site Scripting — https://cwe.mitre.org/data/definitions/79.html (MITRE CWE definition; provides general background on the vulnerability class).
4. Inputmask Library Documentation — https://github.com/RobinHerbots/Inputmask (Referenced by the NVD description as the bundled library whose data-attribute callback binding enables auto-execution; confirm the exact data-attribute behavior to understand the execution mechanism).
5. CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (Checked; CVE-2026-18323 is NOT listed in the KEV catalog as of this report, indicating no confirmed exploitation in the wild has been catalogued by CISA).

Threat actor campaigns and exploit-in-the-wild evidence: No public exploit code, PoC, or confirmed in-the-wild exploitation campaigns have been identified for CVE-2026-18323 at the time of writing. The exploitation potential is nonetheless elevated given the unauthenticated attack vector and the precedent of WordPress plugin XSS vulnerabilities being actively targeted by botnets and opportunistic attackers once details are publicly available.