CVE-2026-102388 WPMU DEV CVE debrief

Who should care

Defenders responsible for WordPress installations using the Forminator plugin should assess exposure and prioritize patching or mitigation to prevent exploitation.

Why it matters

CVE-2026-102388 is a Stored XSS vulnerability in the Forminator plugin for WordPress, affecting versions from n/a through 1.57.3. Defenders should prioritize verifying exposure and applying patches or mitigations to prevent exploitation.

• Defenders should verify exposure and apply patches or mitigations to prevent exploitation.
• Successful exploitation could allow an attacker to inject malicious JavaScript code, potentially leading to unauthorized actions or data theft.
• The vulnerability requires verification from official sources to determine the full scope of affected versions and potential impact.
• Defenders should monitor for potential exploitation attempts and implement additional security measures as needed.

Technical summary

The CVE-2026-102388 vulnerability is a Stored Cross-site Scripting (XSS) issue in the Forminator plugin for WordPress. The vulnerability affects versions from n/a through 1.57.3 and has a CVSS score of 7.1. The vulnerability allows an attacker to inject malicious JavaScript code, which can be executed by other users of the affected system.

Defensive priority

Defenders should prioritize verifying exposure and applying patches or mitigations to prevent exploitation.

Recommended defensive actions

• Verify exposure by checking if the Forminator plugin is installed and if the version is within the affected range.
• Apply patches or updates to the Forminator plugin to address the vulnerability.
• Monitor for potential exploitation attempts and implement additional security measures as needed.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability, with the primary source being the Patchstack audit report. The vulnerability affects versions from n/a through 1.57.3 of the Forminator plugin for WordPress. Defenders should verify exposure and apply patches or mitigations to prevent exploitation. The CVE record was published on 2026-10-10T14:16:36.167Z and has not been modified since then. The Patchstack audit report provides additional details about

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.