CVE-2026-54851: WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Contact Form by WPFormsto a version that resolves this vulnerability.Fixed in 2.0.3.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The vector is network-accessible and requires no privileges, but exploitation requires user interaction. The vulnerability is reflected XSS, so an attacker would need to cause a target to access a crafted request or page.
What are the potential impacts if exploitation succeeds?
The supplied severity vector indicates low impact to confidentiality, integrity, and availability, with scope changed. Successful XSS could allow script execution in the affected web context of a user who interacts with the crafted content.
Which plugin versions are affected?
Contact Form by WPForms (wpforms-lite) is affected through version 2.0.3. The affected version range begins at an unspecified earlier version.