{
 "id": "WPSEC-2026-0580",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0580/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0580/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0580/index.md",
 "title": "Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms <= 2.10.0 - Reflected Cross-Site Scripting via 'error_msg_*' Parameters",
 "description": "The BuddyForms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via error_msg_* query parameters on the BuddyForms login form in all versions up to, and including, 2.10.0. This is due to insufficient input sanitization and output escaping: the error messages were read from the URL and added to the login form HTML without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a crafted link.",
 "plugin": {
  "slug": "buddyforms",
  "name": "Post, Registration and Profile Form Builder – FrontEnd Editor BuddyForms – Easy WordPress Forms",
  "full_name": "BuddyForms",
  "wordpress_org": "https://wordpress.org/plugins/buddyforms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/buddyforms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/buddyforms"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.5.30",
    "from_inclusive": true,
    "to": "2.10.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.5.30 before 2.10.1"
  ]
 },
 "introduced_in": "2.5.30",
 "fixed_in": "2.10.1",
 "remediation": "Update to 2.10.1 or later.",
 "fix_released": "2026-10-03T21:02:24+00:00",
 "published": "2026-10-07T19:47:10+00:00",
 "updated": "2026-10-07T18:51:22.064072+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0580/",
  "https://plugins.svn.wordpress.org/buddyforms/tags/2.10.1/",
  "https://wordpress.org/plugins/buddyforms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/buddyforms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-07"
 }
}