Cool Formkit Lite Advanced Form Builder For Elementor
Monthly
Stored DOM-based cross-site scripting in the Cool FormKit Lite form builder for Elementor (WordPress plugin, slug extensions-for-elementor-form) through version 2.7.9 lets an authenticated attacker with contributor-level access or above plant arbitrary script in a page by setting the '_elementor_data.form_fields[].custom_id' value on an Elementor form widget. The payload fires client-side for any visitor - including anonymous ones - who later loads a page rendering that form, because the plugin's frontend script re-serializes the server-emitted escaped JSON into HTML and the custom_id escapes its attribute context. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the contributor authentication barrier keeps it moderate-priority rather than emergency-tier.
Stored DOM-based cross-site scripting in the Cool FormKit Lite form builder for Elementor (WordPress plugin, slug extensions-for-elementor-form) through version 2.7.9 lets an authenticated attacker with contributor-level access or above plant arbitrary script in a page by setting the '_elementor_data.form_fields[].custom_id' value on an Elementor form widget. The payload fires client-side for any visitor - including anonymous ones - who later loads a page rendering that form, because the plugin's frontend script re-serializes the server-emitted escaped JSON into HTML and the custom_id escapes its attribute context. No public exploit code was identified at time of analysis and the issue is not in CISA KEV; the contributor authentication barrier keeps it moderate-priority rather than emergency-tier.