CVE-2026-118500: Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter

Q: Can an unauthenticated attacker exploit this issue?

No. Exploitation requires an authenticated WordPress account with contributor-level access or higher.

Q: Who is exposed after a malicious payload is saved?

Any user who accesses the injected page can trigger the stored script. The injected script runs in the context of the affected page.

Q: Does the server-side esc_html() call prevent exploitation?

No. The frontend script uses jQuery .html() to extract a template, and HTML fragment serialization restores encoded double quotes in a way that lets the attacker-controlled custom_id escape its intended HTML attribute context.

Published Oct 30, 2026

Updated

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields[].customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The eschtml() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores " to a raw double-quote inside text nodes when jQuery .html() extracts the template, allowing the attacker-controlled customid to break out of an HTML attribute context within the plugin's own frontend script.

Event History

Oct 30, 2026

CVE Published

via MITRE·05:35 AM

Data Sourced

via MITRE·05:35 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Can an unauthenticated attacker exploit this issue?

No. Exploitation requires an authenticated WordPress account with contributor-level access or higher.

Who is exposed after a malicious payload is saved?

Any user who accesses the injected page can trigger the stored script. The injected script runs in the context of the affected page.

Does the server-side esc_html() call prevent exploitation?

No. The frontend script uses jQuery .html() to extract a template, and HTML fragment serialization restores encoded double quotes in a way that lets the attacker-controlled custom_id escape its intended HTML attribute context.

CVE-2026-118500: Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter

Event History

Frequently Asked Questions

Can an unauthenticated attacker exploit this issue?

Who is exposed after a malicious payload is saved?

Does the server-side esc_html() call prevent exploitation?

Company

Resources

Contact

Frequently Asked Questions

Can an unauthenticated attacker exploit this issue?

Who is exposed after a malicious payload is saved?

Does the server-side esc_html() call prevent exploitation?