Atomic Edge analysis of CVE-2026-18325:
This vulnerability allows unauthenticated attackers to perform Stored Cross-Site Scripting (XSS) by forging an upload record via a select field in the Forminator Forms plugin for WordPress. The vulnerability affects all versions up to and including 1.56.1 and carries a CVSS score of 7.2. The attack can execute arbitrary JavaScript in the context of an authenticated administrator’s browser session, leading to potential account takeover, data theft, or site compromise.
Root Cause: The vulnerability stems from two distinct flaws. First, the `Forminator_Core::sanitize_array()` function skips sanitization for any key prefixed with ‘select-‘. This is outlined in the vulnerability description, although the specific patch in this diff instead modifies several field classes. In `library/fields/select.php`, `library/fields/multivalue.php`, and `library/fields/radio.php`, the sanitization callback for array values was updated. The original code at lines 730, 475, and 514 respectively called `trim( wp_kses_post( $val ) )` unconditionally. The patched code checks `is_scalar( $val )` before applying the sanitization, and if the value is not a scalar (e.g., it is an array), it sets the value to an empty string. This prevents an attacker from passing a complex data structure that bypasses sanitization. Second, the `front-action.php` file in custom-forms now unsets a `return` key from `$field_data` at line 1072. The `set_field_data()` function had treated this submitted ‘return’ member as a trusted internal flag, which, combined with the sanitization bypass on the ‘select-‘ keys, allowed an attacker to inject arbitrary values into the form’s submission data.
Exploitation: An unauthenticated attacker crafts a POST request to a form submission endpoint. The request includes multiple ‘select-‘ prefixed parameters with array values instead of strings. For example, a parameter like `select-field-id[]` could be submitted as an array containing the `return` key and a `file_url` value pointing to a malicious JavaScript payload. Because the sanitization routine skips keys prefixed with ‘select-‘, the array structure is preserved. The `set_field_data()` function accepts the forged `return` parameter and uses it to construct a complete upload field record, including the arbitrary `file_url`. When an administrator views the submission data, the malicious script is rendered in their browser. The patch in the field classes now forces all non-scalar values in these fields to become empty strings, breaking the payload structure before it can be persisted. The patch in `front-action.php` also strips the `return` key, removing the trust in that flag.
Patch Analysis: The patch addresses the vulnerability through two primary changes. First, in the sanitization logic for select, multivalue, and radio fields, a direct check `is_scalar( $val )` is added. This ensures that any value which is not a string, integer, float, or boolean is stripped entirely, preventing the injection of complex data structures like arrays. The second change, in `front-action.php`, independently removes the `return` key from the `$field_data` array. This mitigates the vulnerability even if a different part of the application fails to sanitize the input, acting as a defense-in-depth measure. This change is applied before any filters or processing logic runs, making it a robust block against the attack vector from the submission side. The additional change to `helper-fields.php` and `abstract-class-field.php` relates to file upload security, specifically blocking a broader set of dangerous file extensions (normalizing pattern-style keys) and ensuring the .htaccess file is created on all requests to block script execution in the upload directory.
Impact: A successful exploit allows an unauthenticated attacker to inject arbitrary client-side scripts. These scripts will execute whenever an authenticated user, such as an admin, views a page containing the injected payload, such as the form submissions log page. An attacker can use this to steal admin session cookies, create new administrative accounts, modify form configurations, or redirect users to malicious sites. Since the attacker is unauthenticated and the vulnerability is stored, the attack can be staged for future exploitation, presenting a high risk to the integrity and confidentiality of the affected WordPress site.
