EUVD-2026-63812
GHSA-6mv8-cgfh-7rch
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
UI:R corrected from provided UI:N because execution requires an admin to view the entry page; all other metrics align with the unauthenticated network submission and admin-context scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit relies on the plugin's own wp_kses_allowed_html filter widening the 'post' allowlist to permit iframe elements with a data-src attribute, which is not on WordPress's URI-attribute sanitization list, allowing a javascript: URI stored in data-src to survive kses processing and subsequently be promoted to a live src attribute by the bundled admin script view-entry.min.js.
AnalysisAI
Stored Cross-Site Scripting in WPForms Pro for WordPress (all versions through 2.0.0.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form text fields, which execute in the browser of any user who views the stored form entry. The vulnerability exploits a subtle interaction between the plugin's custom kses allowlist expansion - permitting iframes with a data-src attribute - and the WordPress core URI sanitizer's blindspot for that attribute, compounded by the plugin's own admin script promoting data-src to a live src. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | WPForms Pro version 2.0.0.2 or earlier must be installed and active on a WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) reflects the unauthenticated network-accessible attack surface and scope change into the administrative browser context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WPForms Pro to the first version released after 2.0.0.2; consult the official changelog at https://wpforms.com/docs/how-to-view-recent-changes-to-the-wpforms-plugin-changelog/#Changelog to confirm the exact patched version, as a specific fix version was not independently confirmed in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running WPForms Pro and assess the sensitivity of data collected through forms. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which co
The Contact Form & SMTP Plugin by PirateForms plugin for WordPress is vulnerable to HTML injection in the ‘public/class-
The Contact Form & SMTP Plugin for WordPress by PirateForms WordPress plugin before 2.6.0 does not sanitise and escape s
WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attac
A stored cross-site scripting (XSS) vulnerability exists in the WPForms Contact Form (aka wpforms-lite) plugin before 1.
The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high pr
The WPForms WordPress plugin before 1.9.1.6 does not sanitise and escape some of its settings, which could allow high pr
The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on
The WPForms - Easy Form Builder for WordPress - Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vu
Unauth. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low at
The WP Mail SMTP Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check
Missing Authorization vulnerability in WPForms Contact Form by WPForms allows Exploiting Incorrectly Configured Access C
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today