What is the CVSS score of CVE-2026-57379?

CVE-2026-57379 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of FormyChat are affected by CVE-2026-57379?

The WPPOOL FormyChat WordPress plugin (versions ≤2.15.3) contains a stored cross-site scripting flaw that allows attackers to inject malicious JavaScript into contact form submissions, affecting…

How to fix or mitigate CVE-2026-57379?

Within 24 hours, immediately deactivate and remove the WPPOOL FormyChat plugin from all WordPress instances, and deploy an alternative form solution (Gravity Forms, WPForms, or Contact Form 7 with current security updates). Within 7 days, audit the plugin's stored contact form submissions for JavaScript payloads or suspicious input, review web server logs for XSS exploitation attempts, and communicate with administrators to check for unauthorized account activity or privilege changes. Within 30 days, complete migration of all form functionality to the replacement plugin, purge historical submissions from the vulnerable plugin database, and establish a monthly plugin security audit process to prevent future deployment of unsupported plugins.

FormyChat CVE-2026-57379

EUVD-2026-43454 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-13 Patchstack

WordPress XSS Wordpress Plugin Formychat Wppool

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network injection with low complexity (PR:N/AC:L), but execution needs a victim to view the stored payload (UI:R) and crosses into the browser context (S:C) with limited C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:05 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.1

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL FormyChat social-contact-form allows Stored XSS.This issue affects FormyChat: from n/a through <= 2.15.3.

AnalysisAI

Stored cross-site scripting in the WPPOOL FormyChat (social-contact-form) WordPress plugin, versions up to and including 2.15.3, lets remote attackers inject persistent JavaScript that executes in the browser of anyone who later views the affected page. Reported by Patchstack (CVSS 7.1), the scope-changing flaw can be abused to hijack sessions, deface content, or pivot toward WordPress administrator accounts. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Technical ContextAI

FormyChat is a WordPress plugin (CPE cpe:2.3:a:wppool:formychat:*) that adds social/contact chat forms (e.g. WhatsApp-style widgets) to WordPress sites. The root cause is CWE-79, Improper Neutralization of Input During Web Page Generation: attacker-supplied input is written into the generated HTML page without adequate output encoding or sanitization, so a crafted payload is stored server-side and rendered as active markup. Because the injected script runs in the context of the WordPress site's origin, the CVSS scope is marked Changed (S:C) - the vulnerable component (the plugin) affects a separate security authority (the visitor's or administrator's browser session and the surrounding WordPress DOM).

RemediationAI

Upgrade FormyChat to a release later than 2.15.3 (i.e. the first fixed version published after 2.15.3) once available; the input data does not name an exact patched version, so confirm the fixed build directly on the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/social-contact-form/vulnerability/wordpress-formychat-plugin-2-15-3-cross-site-scripting-xss-vulnerability?_s_id=cve) and the WordPress plugin changelog before deploying. As interim compensating controls, deploy a WAF rule or Patchstack's virtual patch to filter script/HTML in FormyChat form submissions, restrict who can submit or view the affected form data, and treat all stored form entries as untrusted when rendering them in wp-admin; if no acceptable fix is reachable, temporarily deactivate the FormyChat plugin, accepting the trade-off that the contact/chat widget will be unavailable to site visitors. A strict Content-Security-Policy that disallows inline script also reduces the blast radius of any residual injection but may break other inline scripts on the site.