EUVD-2026-86578
GHSA-374f-5gff-g472
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated remote submission (AV:N/PR:N/UI:N) stores script that executes in an admin's context (S:C) with limited confidentiality/integrity impact and no availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Articles & Coverage 1
AnalysisAI
Unauthenticated stored cross-site scripting in the Repeater Fields for Elementor Forms plugin (all versions through 2.2.7) allows any anonymous visitor to submit a malicious Repeater Field value through a public Elementor form, which is then stored and executed in the browser of an administrator reviewing form entries or any user loading a page where the value is rendered unescaped. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) reflects remote, low-complexity exploitation requiring no credentials or victim interaction to inject, with a scope change because the payload executes in the victim's browser context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a published, publicly accessible Elementor form on the target site that uses the Repeater Fields for Elementor Forms plugin (version <=2.2.7) with a repeater field an anonymous visitor can populate and submit. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) describes a remotely reachable, low-complexity, unauthenticated (PR:N) stored XSS with a scope change (S:C) - consistent with an attacker submitting a malicious Repeater Field value through a public Elementor form that later executes in a different security context (typically an admin/editor viewing submitted entries, or any visitor of an injected page). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the Repeater Fields for Elementor Forms plugin to version 2.2.8 or later, which contains the vendor's fix (the changed code is visible in Trac changeset 3710785); WordPress administrators can do this from the Plugins screen or via WP-CLI ('wp plugin update repeater-for-elementor'). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every externally reachable site running the Repeater Fields for Elementor Forms plugin at version 2.2.7 or earlier, prioritizing those where anonymous users can submit Elementor forms; where the update cannot be applied immediately, temporarily disable the Repeater Fields add-on or remove public forms that use Repeater Fields, and review recent stored form entries for embedded script content while resetting active administrator sessions and reviewing admin accounts for unexpected changes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today