Form Block CVE-2026-104814

Exploitation targets the Form Block WordPress plugin version 1.8.1 and earlier (vendor epiphyt). No authentication is required (PR:N), but successful attack REQUIRES victim user interaction (UI:R) - the target must load or interact with the attacker-controlled content for the injected script to execute. The limiting factors are: the victim-interaction requirement, impact confined to the victim's browser context (session/data within that session rather than direct server compromise), and dependence on the vulnerable plugin being installed and the affected form/input being reachable. The description does not name the exact vulnerable parameter or field, so the precise injection point is not confirmed from available data.

This is a moderate-severity (CVSS 7.1) unauthenticated reflected/stored XSS in the Form Block WordPress plugin, reported by Patchstack - a credible vulnerability research source for the WordPress ecosystem. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation with no privileges required, but it critically depends on user interaction (UI:R) - a victim must be induced to view the malicious payload. The scope change (S:C) reflects that injected script executes in the victim's browser security context rather than the plugin's. There is NO EPSS score provided, NO CISA KEV listing, and NO public POC indicated in the sources, so exploitation signals are weak: no public exploit identified at time of analysis. Despite the 'high' CVSS band, real-world priority is tempered by the mandatory user-interaction requirement, the limited (Low) confidentiality/integrity/availability impacts typical of XSS, and the niche footprint of this specific plugin. This is a legitimate issue to patch on a normal cadence rather than an emergency; absent EPSS/KEV/POC data, there is no evidence of active or imminent widespread exploitation.

An unauthenticated attacker crafts a malicious script payload and delivers it via a vulnerable Form Block input or a crafted link, which is then reflected or stored and rendered to a victim (a site visitor or logged-in administrator). When the victim views the affected page, the script executes in their browser session, enabling session token theft, actions on the victim's behalf, or admin-account takeover if an administrator is targeted. No public exploit code is identified, and successful attack requires the victim to interact with the malicious content (UI:R).