Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.1 - Unauthenticated Stored Cross-Site Scripting

php`

• Action: forminator_submit_form_ajax (or forminator_submit_poll_ajax)
• Parameter: The value of the "Other" input field (e.g., radio-1-other).
• Authentication: None.

Exploitation Strategy:

1. Identify a Poll or Form with a Radio field that has the "Other" option enabled.
2. Submit the form/poll via AJAX with a payload in the "Other" field.
3. Access the page where the results are displayed (or wait for an admin to view the entries).

Nonce Acquisition:
Forminator forms usually require a nonce for submission.
The nonce is localized in the page source.
JS variable: window.ForminatorFront?.nonce or similar.
Wait, let's look at front.loader.js:

defaults   = {
    // ...
     nonce: false,
    // ...
};
// ...
param.nonce = this.settings.nonce;

The loader uses a nonce.

Let's find the localization key.
In Forminator, it's usually forminator_front_config.
Key: forminator_front_config.admin_ajax_nonce or the form's specific nonce.

Actually, Forminator generates a unique nonce for each form.
It's often found in a hidden input field: name="forminator_nonce".

**Wait, I