Vulnerabilities / Cool FormKit Lite / WPSEC-2026-2580
Cool FormKit Lite <= 2.7.10 - Unauthenticated Arbitrary Shortcode Execution via Form Field Values
High 7.3
CWE-94Fixed in 2.7.11
- ID
- WPSEC-2026-2580
- Plugin
- Cool FormKit Lite – Advanced Form Builder for Elementor (extensions-for-elementor-form)
- Affected
- from 2.4.0 before 2.7.11
- Remediation
- Update to 2.7.11 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-94
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-05
- Attack surface
- Cool FormKit Lite on WPSec AttackSurface
- Fix released
- Published
Description
The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via submitted form field values in all versions up to, and including, 2.7.10. This is due to the Email action substituting user-submitted values for [field id="..."] placeholders in the email content template before passing the result to do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting shortcode syntax in a field that the form's Email action content references.
References
- https://wpsec.com/vuln/WPSEC-2026-2580/
- https://plugins.svn.wordpress.org/extensions-for-elementor-form/tags/2.7.11/
- https://wordpress.org/plugins/extensions-for-elementor-form/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS