CVE-2026-101921: WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute

Q: Which sites are exposed to this issue?

Exposure requires WPForms version 2.0.2.1 or earlier and a previously saved form whose description contains a {query_var} Smart Tag within an iframe srcdoc attribute. The form description must also be shown on a public-facing page with Show Description enabled.

Q: What must an attacker do to exploit it?

The attacker can be unauthenticated, but must cause a user to perform an action such as clicking a crafted link. Exploitation relies on supplying an attacker-chosen parameter key referenced through the {query_var} Smart Tag.

Q: Is a default WPForms installation affected?

The provided conditions indicate this is configuration-dependent rather than universally exposed. A site is affected only if an administrator created the specified form description and exposed that description publicly.

Q: How can I check whether my site has the vulnerable configuration?

Review forms on WPForms 2.0.2.1 or earlier for descriptions that embed {query_var} inside an iframe srcdoc attribute. Then identify whether those forms have Show Description enabled on public-facing pages.

Published Oct 10, 2026

Updated

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag (e.g. "x")' parameter in all versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has previously saved a form whose description embeds a {queryvar} Smart Tag inside an iframe srcdoc attribute and has enabled Show Description on a public-facing page.

Affected Software

1 affected component

WPForms WPForms<=2.0.2.1

Event History

Oct 10, 2026

CVE Published

via MITRE·07:41 AM

Data Sourced

via MITRE·07:41 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are exposed to this issue?

Exposure requires WPForms version 2.0.2.1 or earlier and a previously saved form whose description contains a {query_var} Smart Tag within an iframe srcdoc attribute. The form description must also be shown on a public-facing page with Show Description enabled.

What must an attacker do to exploit it?

The attacker can be unauthenticated, but must cause a user to perform an action such as clicking a crafted link. Exploitation relies on supplying an attacker-chosen parameter key referenced through the {query_var} Smart Tag.

Is a default WPForms installation affected?

The provided conditions indicate this is configuration-dependent rather than universally exposed. A site is affected only if an administrator created the specified form description and exposed that description publicly.

How can I check whether my site has the vulnerable configuration?

Review forms on WPForms 2.0.2.1 or earlier for descriptions that embed {query_var} inside an iframe srcdoc attribute. Then identify whether those forms have Show Description enabled on public-facing pages.

CVE-2026-101921: WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute

Affected Software

Event History

Frequently Asked Questions

Which sites are exposed to this issue?

What must an attacker do to exploit it?

Is a default WPForms installation affected?

How can I check whether my site has the vulnerable configuration?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this issue?

What must an attacker do to exploit it?

Is a default WPForms installation affected?

How can I check whether my site has the vulnerable configuration?