Input validation vulnerability in Forminator Forms – Contact Form, Payment Form & Custom Form Builder 1.42.0

The Forminator Forms plugin for WordPress, which allows users to create contact forms, payment forms, and custom forms, has a vulnerability that can be exploited by attackers. This vulnerability, known as Stored Cross-Site Scripting, occurs because the plugin does not properly sanitize and escape input. This means that attackers with Contributor-level access or higher can inject harmful web scripts into pages, which will run whenever a user visits that page.