CVE-2026-86799: Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated user who can submit a form handled by the vulnerable plugin can supply a malicious form value. The script executes when an administrator opens the affected form submissions screen.
Which plugin versions are affected?
Forms versions before 3.0.2 are affected. Updating to version 3.0.2 or later addresses the vulnerable behavior described.
What can be done if the plugin cannot be updated immediately?
Prevent untrusted users from submitting affected forms, or avoid opening the form submissions screen in the administration dashboard until an update can be applied. Existing submissions may contain malicious values, so treat stored entries as untrusted.
How can administrators identify potentially affected submissions?
Review stored form submissions for unexpected HTML or script-like content, but do so cautiously because viewing a malicious entry in the administration interface can trigger script execution. The issue affects values stored from form submissions and displayed on the submissions screen.