EUVD-2026-46155
GHSA-74qf-x6g6-4pr7
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
AC:H for mandatory OptinMonster co-configuration; PR:L for contributor access; UI:R because a victim must visit the page to trigger script execution.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WPForms - AI Form Builder for WordPress - Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the OptinMonster plugin to be installed and configured with an active inline campaign that outputs matching #om-{id} markup on the target page, as the WPForms handler only fires when OptinMonster emits its 'om.Campaign.load' event.
AnalysisAI
Stored Cross-Site Scripting in WPForms (AI Form Builder for WordPress) through version 2.0.0.1 allows contributor-level authenticated attackers to inject persistent malicious scripts into WordPress pages via an unsanitized data-sitekey attribute in the OptinMonster integration handler. Exploitation is constrained by a high-complexity attack condition: the target site must have OptinMonster installed, configured with an active inline campaign emitting matching #om-{id} markup, since WPForms only processes the vulnerable attribute when OptinMonster fires its 'om.Campaign.load' event. No public exploit code or CISA KEV listing has been identified at time of analysis. The CVSS-assigned scope change (S:C) reflects that injected scripts execute in victims' browser sessions, crossing the security boundary from the server-side WordPress context.
Technical ContextAI
WPForms is a widely-deployed WordPress form-building plugin (CPE: cpe:2.3:a:smub:wpforms_-_ai_form_builder_for_wordpress). The vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) is rooted in the plugin's JavaScript frontend handler (assets/js/frontend/wpforms.min.js), which listens for the OptinMonster 'om.Campaign.load' event and processes a data-sitekey attribute from post content without adequate sanitization or output escaping. The attack vector is the integration bridge between WPForms and OptinMonster - an event-driven callback that trusts attacker-controlled markup in post content. The changeset at plugins.trac.wordpress.org/changeset/3610719 represents the upstream fix applied to wpforms-lite trunk, modifying the vulnerable JS file. Referenced tagged versions 1.10.0.4 and 1.10.2.1 in the Trac browser links appear to document the vulnerable code state for disclosure context.
RemediationAI
Update the WPForms plugin to a version released after 2.0.0.1; the upstream fix has been committed to the wpforms-lite trunk (changeset 3610719 at plugins.trac.wordpress.org), but a specific tagged release version for the patched build is not independently confirmed from the available references - monitor the official WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5264a1-dabf-4630-9871-ab6e14817768 for the confirmed patch release. As an interim compensating control, sites that do not require the OptinMonster integration can deactivate the OptinMonster plugin entirely, which eliminates the 'om.Campaign.load' event trigger and prevents the WPForms handler from processing the vulnerable attribute - this is the most targeted and low-impact workaround. Alternatively, restrict contributor-level and above roles to trusted users only, reducing the pool of accounts capable of injecting malicious post content. Implementing a Content Security Policy (CSP) header that blocks inline script execution can reduce the impact of successful injection, though it does not prevent the stored payload from being written.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today