CVE-2026-86799
Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission
- State
- Published
- Severity
- 8.8 High
- Published
- Oct 14, 2026
- Updated
- Oct 14, 2026
- Reserved
- Sep 8, 2026
Description
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
FormsUnknown |
|
References
- https://wpscan.com/vulnerability/75bdda94-06b3-4747-bcd2-903167ac1c00/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.