Wpforms Pro
Monthly
Stored Cross-Site Scripting in WPForms Pro for WordPress (all versions through 2.0.0.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form text fields, which execute in the browser of any user who views the stored form entry. The vulnerability exploits a subtle interaction between the plugin's custom kses allowlist expansion - permitting iframes with a data-src attribute - and the WordPress core URI sanitizer's blindspot for that attribute, compounded by the plugin's own admin script promoting data-src to a live src. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, though the unauthenticated attack surface and administrative execution context make this a credible priority for WordPress site operators.
The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stored Cross-Site Scripting in WPForms Pro for WordPress (all versions through 2.0.0.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form text fields, which execute in the browser of any user who views the stored form entry. The vulnerability exploits a subtle interaction between the plugin's custom kses allowlist expansion - permitting iframes with a data-src attribute - and the WordPress core URI sanitizer's blindspot for that attribute, compounded by the plugin's own admin script promoting data-src to a live src. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, though the unauthenticated attack surface and administrative execution context make this a credible priority for WordPress site operators.
The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.