{
 "id": "WPSEC-2026-2528",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2528/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2528/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2528/index.md",
 "title": "cformsII <= 15.1.4 - Unauthenticated HTML Injection via Form Field Values in HTML Emails",
 "description": "The cformsII plugin for WordPress is vulnerable to HTML Injection via submitted form field values in all versions up to, and including, 15.1.4, due to user-supplied values being substituted into {field} variables of the HTML admin notification and auto-confirmation email templates without escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML markup, such as misleading links or content, into emails sent by the site, including auto-confirmation emails sent to an address the attacker supplies, when HTML emails are enabled.",
 "plugin": {
  "slug": "cforms2",
  "name": "cformsII",
  "full_name": "cformsII",
  "wordpress_org": "https://wordpress.org/plugins/cforms2/",
  "advisories_url": "https://wpsec.com/vuln/plugin/cforms2/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/cforms2"
 },
 "type": "CONTENT INJECTION",
 "cwe": [
  "CWE-80"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "15.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 15.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "15.2",
 "remediation": "Update to 15.2 or later.",
 "fix_released": "2026-11-03T22:27:43+00:00",
 "published": "2026-11-04T22:49:09+00:00",
 "updated": "2026-11-04T14:28:28.742448+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2528/",
  "https://plugins.svn.wordpress.org/cforms2/tags/15.2/",
  "https://wordpress.org/plugins/cforms2/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/cforms2",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-04"
 }
}