WPForms <= 2.0.3 - Unauthenticated Reflected Cross-Site Scripting via Field Value Smart Tags in Confirmation Message
- ID
- WPSEC-2026-2070
- Plugin
- WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More (wpforms-lite)
- Affected
- all versions before 2.0.3.1
- Remediation
- Update to 2.0.3.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-30
- Attack surface
- WPForms on WPSec AttackSurface
- Fix released
- Published
Description
The WPForms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the field_id, field_value_id and field_html_id smart tags in all versions up to, and including, 2.0.3, due to insufficient sanitization of submitted field values that these smart tags print into the front-end confirmation message. The values were only filtered with wp_kses_post, which keeps form controls and data-* attributes and can rebuild plain submitted text into real HTML tags that the front-end validation script then renders as HTML. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser if they can trick the victim into submitting a crafted cross-site form post and interacting with the injected content. Exploitation requires a confirmation message that uses one of these smart tags, a form that accepts non-AJAX submissions, and the plugin's validation script loading on the confirmation page, such as when another WPForms form is on the same page.
References
- https://wpsec.com/vuln/WPSEC-2026-2070/
- https://plugins.svn.wordpress.org/wpforms-lite/tags/2.0.3.1/
- https://wordpress.org/plugins/wpforms-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS