What is the CVSS score of CVE-2026-13378?

CVE-2026-13378 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Form Vibes are affected by CVE-2026-13378?

The Form Vibes WordPress plugin (versions through 1.5.2) enables unauthenticated attackers to inject persistent malicious code through contact form submissions that executes in administrator browsers…

How to fix or mitigate CVE-2026-13378?

24 hours: Inventory all WordPress instances running Form Vibes; assess active usage and review admin audit logs for suspicious entry-view activity. 7 days: Disable Form Vibes plugin on all affected sites; restrict WordPress admin dashboard network access to known office IP ranges; migrate form collection to hardened alternatives (WPForms 1.8.5+, Ninja Forms 3.7.0+, Contact Form 7 with strict input sanitization rules). 30 days: Remove plugin completely; implement Content Security Policy headers blocking inline scripts; enable multi-factor authentication on all administrator accounts; conduct forensic review of all form submissions during exposure window for signs of injection attempts.

Form Vibes CVE-2026-13378

EUVD-2026-43147 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-11 Wordfence

GHSA-r6rx-xwfp-wpj4

WordPress XSS Wordpress Plugin Form Vibes Save Contact Form 7 Elementor Form Entries To Database Wpvibes

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Unauthenticated public submission gives PR:N/AV:N/AC:L, but the stored payload only fires when an admin views entries, so UI:R; scope change (S:C) as script runs in the admin browser context with limited C/I impact and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 06:23 vuln.today

CVE Published

Jul 11, 2026 - 04:32 nvd

HIGH 7.2

DescriptionCVE.org

The Form Vibes - Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Articles & Coverage 1

News 16 New WordPress Vulnerabilities - 16 High Severity Jul 12, 2026

AnalysisAI

Stored cross-site scripting in the Form Vibes - Database Manager for Forms WordPress plugin (all versions through 1.5.2) lets unauthenticated attackers persist malicious JavaScript by submitting a crafted Contact Form 7 field, which the plugin stores and later renders unescaped in the WordPress admin entries view. Because sanitization and output escaping are both insufficient, the injected script executes in the browser of any user (typically a logged-in administrator) who opens the captured submissions. No public exploit is identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, no-privilege injection vector combined with scope-changing impact makes it a practical account-takeover risk for exposed sites.

Technical ContextAI

The affected component is Form Vibes, a WordPress plugin (vendor WP Vibes, CPE cpe:2.3:a:wpvibes:form_vibes_...) that captures form submissions from Contact Form 7 and Elementor into the WordPress database for later viewing in the admin dashboard. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): field data arriving from a public-facing Contact Form 7 submission is written to the database without adequate sanitization and then emitted into the admin entries UI without output escaping. The referenced source paths - inc/integrations/cf7.php (CF7 capture at line 126), inc/integrations/base.php (line 141), and the front-end assets/dist/js/submission.js - indicate the capture-and-render pipeline where untrusted form-field content is trusted on output. This is a classic second-order/stored XSS: the payload is delivered through the normal form-submission path and only fires later when an operator opens the stored entry.

RemediationAI

No vendor-released patched version is stated in the available data - all versions up to and including 1.5.2 are affected - so no fixed release number can be confirmed; a WordPress.org changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3599917%40form-vibes&new=3597349%40form-vibes) is referenced and may correspond to an upstream fix, but a tagged patched version is not independently confirmed. Administrators should monitor the plugin page and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/c6716a5d-48ed-4735-b765-a7606ea401d0?source=cve) and upgrade to the first release above 1.5.2 as soon as it is published. Until a confirmed patched version exists, compensating controls include deploying a WAF rule (Wordfence or equivalent) to filter script tags and HTML in Contact Form 7 submissions, restricting or IP-allowlisting access to the WordPress admin/Form Vibes entries screens so submissions are only viewed from trusted contexts, and - if CF7-to-database capture is not business-critical - temporarily disabling the Form Vibes CF7 integration or deactivating the plugin, accepting the trade-off that captured entries will no longer be recorded. Reviewing and purging suspicious already-stored entries before an admin opens them further reduces the trigger window.