Wpzoom Forms Contact Form Plugin For Gutenberg
Monthly
Stored Cross-Site Scripting in WPZOOM Forms - Contact Form Plugin for Gutenberg versions up to and including 2.0.4 allows authenticated Contributors to inject malicious JavaScript that executes in the browsers of higher-privileged users such as site administrators. The vulnerability stems from insufficient sanitization or escaping of user-supplied input before it is rendered in WordPress pages, a CWE-79 root cause confirmed by Patchstack and the ENISA EUVD entry EUVD-2026-60924. No public exploit identified at time of analysis and the flaw is absent from the CISA KEV catalog, but the Contributor-to-Administrator privilege escalation path makes this a meaningful risk on any multi-author WordPress deployment.
Stored Cross-Site Scripting in WPZOOM Forms - Contact Form Plugin for Gutenberg versions up to and including 2.0.4 allows authenticated Contributors to inject malicious JavaScript that executes in the browsers of higher-privileged users such as site administrators. The vulnerability stems from insufficient sanitization or escaping of user-supplied input before it is rendered in WordPress pages, a CWE-79 root cause confirmed by Patchstack and the ENISA EUVD entry EUVD-2026-60924. No public exploit identified at time of analysis and the flaw is absent from the CISA KEV catalog, but the Contributor-to-Administrator privilege escalation path makes this a meaningful risk on any multi-author WordPress deployment.