EUVD-2026-14174
GHSA-rww4-4g7g-fx67
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Integration with Hubspot Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hubspotform' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Integration with Hubspot Forms WordPress plugin (all versions up to 1.2.2) due to insufficient input sanitization and output escaping on shortcode attributes. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript into pages via the 'hubspotform' shortcode, which executes whenever users access the compromised page. While no public exploit-in-the-wild activity has been reported, the vulnerability is straightforward to exploit and poses a moderate risk given the low privilege requirement and broad attack surface in WordPress environments.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic Stored XSS flaw. The affected product is the Integration with Hubspot Forms plugin (CPE: cpe:2.3:a:minnur:integration_with_hubspot_forms:*:*:*:*:*:*:*:*) for WordPress, specifically the EmbedHubspotForms.php component at line 183 where shortcode attributes are processed. The plugin fails to properly sanitize user-supplied input and escape output when rendering the [hubspotform] shortcode, allowing malicious script injection. WordPress shortcodes are a core templating mechanism that developers often mishandle regarding security; improper attribute handling in shortcode callbacks is a recurring vulnerability class in the WordPress ecosystem.
RemediationAI
Upgrade the Integration with Hubspot Forms plugin to version 1.2.3 or later, which should address the input sanitization and output escaping defects. WordPress administrators should immediately check the plugin repository for patch availability and apply updates across all affected installations. As an interim measure, restrict the [hubspotform] shortcode to trusted administrators only by implementing a custom post type or editorial review workflow requiring approval before pages containing the shortcode are published. Additionally, limit Contributor-level access to only trusted team members and monitor post revisions for unauthorized shortcode injection using WordPress security plugins (e.g., Wordfence, Sucuri) that detect XSS patterns. See https://www.wordfence.com/threat-intel/vulnerabilities/id/aac2b2a3-5d4f-449f-876c-d1bec295e088?source=cve for vendor advisories and patch status.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today