CVE-2026-86799
8.8HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-79
Impact
Unauthenticated attackers can execute arbitrary JavaScript in an administrator's browser to hijack sessions or compromise the site. This requires an admin to view the stored form submissions in the dashboard.
Root cause
The plugin stores raw form submissions without sanitization and renders them in the admin dashboard without output escaping, causing stored cross-site scripting.
Affected systems
Forms WordPress plugin before 3.0.2
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade the Forms plugin to version 3.0.2 or later. If patching immediately is not possible, deactivate the plugin to prevent admins from viewing poisoned submissions.
$ wp plugin update formsAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.