What is the CVSS score of CVE-2026-61947?

CVE-2026-61947 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Form Vibes are affected by CVE-2026-61947?

The Form Vibes WordPress plugin (versions ≤ 1.5.2) contains an unauthenticated reflected cross-site scripting vulnerability (CVSS 7.1) enabling attackers to inject malicious scripts that compromise…

How to fix or mitigate CVE-2026-61947?

Within 24 hours, audit all WordPress installations for Form Vibes plugin presence and identify instances running version 1.5.2 or earlier; document the plugin's operational importance to your organization. Within 7 days, either disable the plugin entirely if functionality is non-essential, or implement compensating controls including strict Content Security Policy headers (script-src 'self'), WAF rules to block XSS attack patterns in form submissions, and IP-based access restrictions on plugin administration interfaces. Within 30 days, monitor vendor advisories for security updates and develop a plan to remove or replace the plugin with a maintained alternative, given the current absence of a vendor-released patch.

Form Vibes CVE-2026-61947

EUVD-2026-48205 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-f3xw-4jx3-6m8r

WordPress XSS Wordpress Plugin Form Vibes Database Manager For Forms Wpvibes

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Unauthenticated network XSS (PR:N, AV:N) requiring victim interaction (UI:R) with scope change to the browser context (S:C); low confidentiality/integrity impact and no genuine availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:41 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Form Vibes - Database Manager for Forms <= 1.5.2 versions.

AnalysisAI

Reflected/unauthenticated Cross-Site Scripting in the Form Vibes - Database Manager for Forms WordPress plugin (versions <= 1.5.2) lets a remote attacker inject script that executes in a victim's browser after they follow a crafted link or interact with attacker-controlled input. Because the CVSS scope is changed (S:C), successful execution can affect the wider WordPress session/DOM context, and with PR:N no authentication is required to launch the attack. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; risk hinges on user interaction (UI:R).

Technical ContextAI

The affected component is Form Vibes, a WordPress plugin (vendor wpvibes, CPE cpe:2.3:a:wpvibes:form_vibes_-_database_manager_for_forms) that captures, stores, and displays form submission data from other form plugins. The weakness is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied data is reflected or persisted into an HTML response without adequate output encoding or input sanitization. In WordPress form-data managers this class of bug commonly arises when submission fields or query parameters are rendered into admin dashboards or public pages without escaping via WordPress APIs such as esc_html()/esc_attr()/wp_kses(), allowing HTML/JavaScript to be interpreted by the browser.

RemediationAI

Upgrade Form Vibes to the vendor's patched release above 1.5.2 once confirmed via the WordPress plugin repository or the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/form-vibes/vulnerability/wordpress-form-vibes-database-manager-for-forms-plugin-1-5-2-cross-site-scripting-xss-vulnerability); the input does not specify an exact fix version, so no vendor-released patch version is independently confirmed here. If a patched build is not yet deployable, apply compensating controls: place a Web Application Firewall (Patchstack, Wordfence, or Cloudflare managed rules) in front of the site to filter XSS payloads in form submissions and request parameters (trade-off: rules may need tuning and can miss novel encodings); restrict access to the Form Vibes data-viewing/admin screens to trusted authenticated admins only (trade-off: does not stop payloads stored via public submission paths, but limits who renders them); and consider temporarily deactivating the plugin if the affected screens are non-essential (trade-off: loss of form-data capture/reporting). A restrictive Content-Security-Policy limiting inline script execution further reduces impact of any reflected payload.