{
 "id": "WPSEC-2026-2580",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2580/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2580/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2580/index.md",
 "title": "Cool FormKit Lite <= 2.7.10 - Unauthenticated Arbitrary Shortcode Execution via Form Field Values",
 "description": "The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Arbitrary Shortcode Execution via submitted form field values in all versions up to, and including, 2.7.10. This is due to the Email action substituting user-submitted values for [field id=\"...\"] placeholders in the email content template before passing the result to do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting shortcode syntax in a field that the form's Email action content references.",
 "plugin": {
  "slug": "extensions-for-elementor-form",
  "name": "Cool FormKit Lite",
  "full_name": "Cool FormKit Lite – Advanced Form Builder for Elementor",
  "wordpress_org": "https://wordpress.org/plugins/extensions-for-elementor-form/",
  "advisories_url": "https://wpsec.com/vuln/plugin/extensions-for-elementor-form/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/extensions-for-elementor-form"
 },
 "type": "RCE",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.4.0",
    "from_inclusive": true,
    "to": "2.7.11",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.4.0 before 2.7.11"
  ]
 },
 "introduced_in": "2.4.0",
 "fixed_in": "2.7.11",
 "remediation": "Update to 2.7.11 or later.",
 "fix_released": "2026-11-04T12:09:02+00:00",
 "published": "2026-11-05T12:51:17+00:00",
 "updated": "2026-11-05T09:51:41.186716+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2580/",
  "https://plugins.svn.wordpress.org/extensions-for-elementor-form/tags/2.7.11/",
  "https://wordpress.org/plugins/extensions-for-elementor-form/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/extensions-for-elementor-form",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-05"
 }
}