WPForms Pro CVE-2026-18409

WPForms Pro version 2.0.0.2 or earlier must be installed and active on a WordPress site. A form containing at least one Single Line Text or Paragraph Text field must be publicly accessible (i.e., reachable by unauthenticated users who can submit entries). The XSS payload executes specifically when a privileged user - typically a WordPress administrator - opens the form entries view in the wp-admin dashboard, which is the routine path for reviewing form submissions. There are no additional non-default configuration requirements: the vulnerable kses filter expansion and the view-entry.min.js script behavior are present by default in the affected plugin versions. Exploitation is limited to sites where public form submission is enabled and where an administrator actively reviews stored entries; sites where form submission is restricted to authenticated users would require a lower-privilege authenticated attacker rather than a fully unauthenticated one.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, score 7.2) reflects the unauthenticated network-accessible attack surface and scope change into the administrative browser context. However, the UI:N metric is atypical for stored XSS: execution does require an administrator or user to navigate to the form entry view, which maps more naturally to UI:R under the CVSS 3.1 specification. If scored UI:R the base score would be approximately 6.1, still Medium-High. No EPSS score was provided and the CVE is not listed in CISA KEV, indicating no confirmed widespread exploitation at time of analysis. The Wordfence report is a credible primary source. Real-world risk is elevated by several factors: the attack requires zero authentication, WPForms Pro is broadly deployed across commercial WordPress sites, the trigger (admin reviewing form submissions) is routine operational behavior, and successful exploitation in the admin context can enable follow-on account compromise, backdoor injection via the plugin/theme editor, or full site takeover. The absence of a POC and KEV listing somewhat moderates urgency, but the low attack complexity and high deployment footprint warrant prompt patching. CVSS signals and description are consistent - no apparent contradictions.

An unauthenticated attacker locates a publicly accessible WordPress site running WPForms Pro and submits a contact or lead-capture form, placing a crafted payload - an iframe element with a javascript: URI in the data-src attribute - into a Single Line Text or Paragraph Text field. Because WPForms Pro's kses filter permits iframes with data-src and WordPress does not treat data-src as a URI-type attribute requiring sanitization, the payload is stored intact in the database. When a site administrator subsequently opens the Entries view to review form submissions, view-entry.min.js reads the stored data-src value and writes it into the iframe's src, causing the administrator's browser to execute the attacker's JavaScript in the WordPress admin session context, enabling session cookie theft or further administrative actions.