Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92144 · Microsoft / collected KEV context

cve-program · CVE-2026-92144

• https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f320d2-fd24-47b5-804d-31e3afdc31ba?source=cve
• https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.2/library/class-core.php#L690
• https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.2/library/class-core.php#L756
• https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.2/library/fields/postdata.php#L1012
• https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.2/library/abstracts/abstract-class-front-action.php#L973
• https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.2/library/abstracts/abstract-class-front-action.php#L127
• https://plugins.trac.wordpress.org/browser/forminator/tags/1.57.2/library/modules/custom-forms/front/front-action.php#L3528
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3700709%40forminator%2Ftags%2F1.57.2.1&old=3668424%40forminator%2Ftags%2F1.57.2
• https://plugins.trac.wordpress.org/changeset/3700690/forminator/trunk/library/abstracts/abstract-class-front-action.php

No related operational record is retained in the current change model.