Vulnerabilities / cformsII / WPSEC-2026-2528
cformsII <= 15.1.4 - Unauthenticated HTML Injection via Form Field Values in HTML Emails
Medium 4.3
CWE-80Fixed in 15.2
- ID
- WPSEC-2026-2528
- Plugin
- cformsII (cforms2)
- Affected
- all versions before 15.2
- Remediation
- Update to 15.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- Weakness
- CWE-80
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-04
- Attack surface
- cformsII on WPSec AttackSurface
- Fix released
- Published
Description
The cformsII plugin for WordPress is vulnerable to HTML Injection via submitted form field values in all versions up to, and including, 15.1.4, due to user-supplied values being substituted into {field} variables of the HTML admin notification and auto-confirmation email templates without escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML markup, such as misleading links or content, into emails sent by the site, including auto-confirmation emails sent to an address the attacker supplies, when HTML emails are enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2528/
- https://plugins.svn.wordpress.org/cforms2/tags/15.2/
- https://wordpress.org/plugins/cforms2/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS