# cformsII <= 15.1.4 - Unauthenticated HTML Injection via Form Field Values in HTML Emails

- **ID:** WPSEC-2026-2528
- **Plugin:** cformsII (`cforms2`), https://wordpress.org/plugins/cforms2/
- **Affected versions:** all versions before 15.2
- **Fixed in:** 15.2 (Update to 15.2 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-80
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/cforms2
- **Fix released:** 2026-11-03
- **Published:** 2026-11-04
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2528/

## Description

The cformsII plugin for WordPress is vulnerable to HTML Injection via submitted form field values in all versions up to, and including, 15.1.4, due to user-supplied values being substituted into {field} variables of the HTML admin notification and auto-confirmation email templates without escaping. This makes it possible for unauthenticated attackers to inject arbitrary HTML markup, such as misleading links or content, into emails sent by the site, including auto-confirmation emails sent to an address the attacker supplies, when HTML emails are enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2528/
- https://plugins.svn.wordpress.org/cforms2/tags/15.2/
- https://wordpress.org/plugins/cforms2/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2528/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.