WPForms CVE-2026-88996

Exploitation requires a vulnerable form whose admin-authored confirmation message embeds the {page_title} Smart Tag inside an HTML attribute context - this is a non-default authoring configuration, so many WPForms deployments are not exploitable. Attack is remote and unauthenticated (PR:N) but requires user interaction (UI:R): the victim must be tricked into an action such as clicking a crafted link that submits the malicious 'page_title' POST value. Affected: all WPForms AI Form Builder versions up to and including 2.0.2. Impact is limited to script execution in the victim's browser context (scope change), not the server.

This is a genuine but modest-severity reflected XSS (CWE-79) in WPForms, one of the most widely deployed WordPress form plugins. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N = 6.1 Medium) correctly captures the shape: network-reachable, unauthenticated, but requiring victim interaction (UI:R) and yielding only limited confidentiality/integrity impact scoped to the victim's browser session. No EPSS score, no CISA KEV listing, and no public proof-of-concept are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' The single most important risk-limiting signal is NOT in the raw CVSS: the description explicitly states the flaw is 'only exploitable on forms whose admin-authored confirmation message places the {page_title} Smart Tag inside an HTML attribute context' - a non-default authoring choice that dramatically shrinks the exploitable population below the plugin's install base. Net: despite the large footprint, this is a lower-priority, interaction-and-configuration-gated reflected XSS rather than a wormable or mass-exploitable issue. Patch is available (Wordfence-reported, fixed in versions after 2.0.2 per trac changeset 3709178), so prioritize normal patch cycles.

An attacker crafts a malicious URL to a vulnerable WPForms-hosted form page, embedding a JavaScript payload in the 'page_title' POST parameter that is reflected via the {page_title} Smart Tag into an HTML attribute inside the form's confirmation message. The attacker phishes a logged-in site user or admin into submitting/clicking the crafted link; on execution the script runs in the victim's browser session, enabling session/cookie theft or actions in the victim's context. No public PoC is identified, and success depends on the target form being configured with the Smart Tag in an attribute context and on the victim performing the action (UI:R).