CVE-2026-107658: BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusion
The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bfposttype (and buddyformsformcontent)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that at least one BuddyForms form with public submissions enabled exists on the site (so that the required nonce can be harvested from the public form page) and that the active theme registers a widgetized sidebar, allowing the injected customizechangeset to place a malicious Custom HTML widget into the site's front end.
Event History
Frequently Asked Questions
Which sites are realistically exposed to exploitation?
A site is exposed only if it has at least one BuddyForms form that allows public submissions and its active theme registers a widgetized sidebar. Both conditions are required for the described attack path.
What does an attacker need to exploit this issue?
The attacker does not need authentication, but must be able to harvest the required nonce from a publicly accessible BuddyForms submission form. They also rely on the theme's widgetized sidebar to place a malicious Custom HTML widget on the front end.
What is the impact if exploitation succeeds?
An attacker can store arbitrary web script in an injected page. The script executes when a user accesses that injected page, with confidentiality and integrity impact rated low.
What can be done while an update is unavailable?
Disable public submissions for BuddyForms forms or otherwise prevent public access to the form page so the nonce cannot be harvested. Using a theme without a widgetized sidebar also prevents the described widget-placement attack path.