CVE-2026-104814: WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability
Published Oct 6, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.
Affected Software
1 affected component
WordPress Form Block Plugin<=1.8.1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Form Block pluginto a version that resolves this vulnerability.Fixed in 1.8.2
Event History
Oct 6, 2026
CVE Published
via MITRE·08:35 AM
Data Sourced
via MITRE·08:35 AM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Does an attacker need an account or other privileges to exploit this issue?
No. The vulnerability is described as unauthenticated, so exploitation does not require a WordPress account or prior privileges.
2
Does successful exploitation require someone to interact with attacker-controlled content?
Yes. The vector includes UI:R, indicating that user interaction is required for exploitation.
3
Which plugin versions are affected?
Form Block plugin versions 1.8.1 and earlier are affected according to the available information.