# WPForms <= 2.0.3 - Unauthenticated Reflected Cross-Site Scripting via Field Value Smart Tags in Confirmation Message

- **ID:** WPSEC-2026-2070
- **Plugin:** WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More (`wpforms-lite`), https://wordpress.org/plugins/wpforms-lite/
- **Affected versions:** all versions before 2.0.3.1
- **Fixed in:** 2.0.3.1 (Update to 2.0.3.1 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wpforms-lite
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2070/

## Description

The WPForms plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the field_id, field_value_id and field_html_id smart tags in all versions up to, and including, 2.0.3, due to insufficient sanitization of submitted field values that these smart tags print into the front-end confirmation message. The values were only filtered with wp_kses_post, which keeps form controls and data-* attributes and can rebuild plain submitted text into real HTML tags that the front-end validation script then renders as HTML. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in a victim's browser if they can trick the victim into submitting a crafted cross-site form post and interacting with the injected content. Exploitation requires a confirmation message that uses one of these smart tags, a form that accepts non-AJAX submissions, and the plugin's validation script loading on the confirmation page, such as when another WPForms form is on the same page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2070/
- https://plugins.svn.wordpress.org/wpforms-lite/tags/2.0.3.1/
- https://wordpress.org/plugins/wpforms-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2070/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.