CVE-2026-95816

7.2High

Published 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated attackers can store malicious JavaScript that executes when users or admins view submitted forms. They only need network access to the site's AJAX endpoint on default configurations.

Root cause

The rednao_smart_forms_save_form_values AJAX handler fails to sanitize or escape the formString parameter and skips nonce verification unless anonymous submissions are explicitly blocked.

Affected systems

Smart Forms WordPress plugin versions up to and including 2.6.104

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade Smart Forms to a version newer than 2.6.104 if available. If patching must wait, enable the smart_forms_block_anonymous_submissions option or disable the plugin.

shell

$ wp plugin update smart-forms

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce check protecting the rednao_smart_forms_save_form_values AJAX handler is only enforced when the smart_forms_block_anonymous_submissions option is enabled, meaning default installations require no authentication or nonce verification whatsoever to submit and store malicious payloads.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-95816