WPForms CVE-2026-15782

Exploitation requires: (1) the attacker holds at minimum contributor-level WordPress access, authenticated per CVSS PR:L; (2) the WPForms plugin version 2.0.0.1 or earlier is installed; (3) the OptinMonster plugin is separately installed and actively configured with an inline campaign that outputs #om-{id} markup on the target page - this is a hard dependency, as the WPForms vulnerable handler only fires when OptinMonster emits its 'om.Campaign.load' event; (4) a victim user must subsequently visit the injected page while that OptinMonster campaign is active. Exploitation is limited by: contributor-level authentication requirement (not anonymous), the mandatory co-presence of a correctly configured OptinMonster campaign (non-default, third-party plugin dependency), and the need for a victim to visit the affected page. Sites without OptinMonster installed are entirely unaffected regardless of WPForms version.

The CVSS base score of 4.9 (Medium) with vector AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N signals a real but constrained risk. AC:H correctly reflects the non-trivial attack preconditions: OptinMonster must be installed, actively configured with an inline campaign, and emitting #om-{id} markup on the same page - this is a dependency that materially limits the exposed attack surface. PR:L (contributor-level) is the minimum privilege, which on many WordPress sites is a low-privilege role available to external contributors or even registered users depending on site configuration. The UI:N assignment is notable and diverges from typical stored XSS classification, which usually carries UI:R because a victim must visit the injected page; this metric warrants independent verification against NVD scoring rationale. No EPSS data was provided, no CISA KEV listing exists, and no public exploit code has been identified - making this a low-urgency issue for sites that do not use OptinMonster, and a medium-priority patch for sites that do. The scope change (S:C) elevates the theoretical impact: a successful injection could enable session hijacking, credential theft, or admin account takeover if a privileged user visits the affected page.

An attacker with contributor-level access to a WordPress site using both WPForms and OptinMonster logs in and edits a post or page, injecting a malicious data-sitekey attribute containing JavaScript into WPForms-related markup in the post content. When an administrator or authenticated user later visits that page - and OptinMonster fires its 'om.Campaign.load' event for an active inline campaign on the same page - the WPForms frontend handler processes the unsanitized attribute, causing the injected script to execute in the victim's browser session. No public exploit code has been identified, but the attack requires only standard browser tools and knowledge of the OptinMonster event trigger.