WPForms Contact Form CVE-2026-54851

Exploitation requires the attacker to deliver a crafted link carrying the XSS payload and to convince a victim to click it (UI:R); the payload is reflected and executed only during that victim's request, so there is no persistent compromise. No authentication is required of the attacker (PR:N), but impact is amplified if the victim is an authenticated WordPress user such as an administrator. The specific vulnerable parameter, endpoint, or configuration precondition is not described in the available sources. The principal limiting factor is the mandatory per-victim social-engineering step, which prevents automated or mass exploitation without user interaction.

This is a reflected cross-site scripting (CWE-79) flaw in the widely deployed Contact Form by WPForms (wpforms-lite) plugin, carrying a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The CVSS vector indicates a network-reachable, low-complexity attack requiring no attacker privileges (PR:N) but mandating victim interaction (UI:R), with a changed scope reflecting execution in the victim's browser context. The vuln.today decision label is 'this_week', indicating a prompt but non-emergency remediation priority. No CISA KEV listing is present, so there is no confirmation of active exploitation, and no EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified from the input. No proof-of-concept or exploit reference is provided - only the Patchstack advisory describing the issue. Reflected XSS, unlike stored XSS, requires per-victim social engineering (a crafted link) rather than passive compromise, which materially lowers real-world urgency compared to the 7.1 'High' label; this is a genuine issue worth patching this week but not an actively-exploited emergency on current evidence. Note the signals are consistent (no KEV, no EPSS, no POC, 'this_week' label all align toward moderate priority) rather than conflicting.

An unauthenticated attacker crafts a URL containing a malicious script payload targeting the vulnerable plugin parameter and uses phishing or a malicious link to lure a logged-in WordPress user (ideally an administrator) into clicking it. When the victim loads the link, the unsanitized input is reflected into the page and the script executes in their browser session, enabling session/cookie theft, admin-panel actions, or page manipulation. No public exploit code is referenced in the available data; the specific vulnerable endpoint or parameter is not described in the source.