What is the CVSS score of CVE-2026-32532?

CVE-2026-32532 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Contact Form Lead Form Elementor Builder are affected by CVE-2026-32532?

CVE-2026-32532 presents moderate security risk, a cross-site scripting vulnerability rated CVSS 7.1.

How to fix or mitigate CVE-2026-32532?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Verify anti-CSRF tokens and content security policies are enforced.

Contact Form Lead Form Elementor Builder CVE-2026-32532

EUVD-2026-15903 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-25 Patchstack

GHSA-prm5-vp6h-vqjq

XSS Contact Form Lead Form Elementor Builder Elementor

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15903

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Stored XSS.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.

AnalysisAI

A Stored Cross-Site Scripting (XSS) vulnerability exists in ThemeHunk's Contact Form & Lead Form Elementor Builder plugin for WordPress, affecting all versions through 2.0.1. An attacker can inject malicious scripts into form fields that are stored in the database and executed in the browsers of administrators or other users who view the submitted data, potentially leading to account takeover, data theft, or malware distribution. No CVSS score or EPSS data is currently available, and active exploitation status is unknown; however, the vulnerability is confirmed by Patchstack and tracked under ENISA EUVD-2026-15903.

Technical ContextAI

The vulnerability stems from improper input validation and output encoding in a WordPress plugin built for the Elementor page builder framework. CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates that user-supplied input from contact or lead forms is not adequately sanitized or escaped before being rendered in HTML context. The plugin (identified by CPE cpe:2.3:a:themehunk:contact_form_&_lead_form_elementor_builder:*:*:*:*:*:*:*:*) processes form submissions via Elementor widgets but fails to apply WordPress escaping functions (such as esc_html(), wp_kses_post(), or sanitize_text_field()) consistently across all form field types. When form data is later displayed in the WordPress admin dashboard or frontend, the unescaped malicious payload executes in the user's browser context, allowing session hijacking or privilege escalation attacks.

RemediationAI

Immediately update the Contact Form & Lead Form Elementor Builder plugin to the latest version released by ThemeHunk after 2.0.1; check the Patchstack database entry (https://patchstack.com/database/Wordpress/Plugin/lead-form-builder/vulnerability/wordpress-contact-form-lead-form-elementor-builder-plugin-2-0-1-cross-site-scripting-xss-vulnerability?_s_id=cve) for the patched version number and download it from the official WordPress.org plugin repository. If a patched version is not yet available, disable the plugin temporarily and replace it with an alternative form builder (such as WPForms, Gravity Forms, or Forminator) until a patch is released. Additionally, review stored form submissions in the WordPress database and any exported form data for evidence of malicious payloads; if found, sanitize or delete affected entries. As a preventive measure, implement WordPress security hardening practices such as using the Wordfence or Sucuri security plugins to monitor for XSS injection attempts and enforce content security policies via HTTP headers.