FormGent – Next-Gen AI Form Builder for WordPress With Multi-Step, Quizzes, Payments & More (1.9.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/formgent--next-gen-ai-form-builder-for-wordpress-with-multi-step-quizzes-payments--more-1.9.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 06 Aug 2026 13:23:56 +0000Stored XSS Vulnerability in FormGent WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-08-formgent-xss/Thu, 06 Aug 2026 13:23:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-formgent-xss/An unauthenticated stored cross-site scripting vulnerability in FormGent versions 1.9.2 and below allows attackers to inject malicious scripts into form fields that execute upon viewing.The FormGent AI Form Builder plugin for WordPress (versions 1.9.2 and below) contains a critical stored cross-site scripting (XSS) vulnerability. The flaw exists due to insufficient sanitization of user-supplied data within form submission fields. Because the plugin fails to properly escape input before rendering it on administrative or public-facing pages, an unauthenticated attacker can submit malicious JavaScript payloads through the plugin's forms. Once submitted, these scripts are stored in the WordPress database and automatically execute in the browser context of any user, including administrators, who subsequently accesses the page where the form entries are displayed. This vulnerability poses a significant risk for account takeover, session theft, and unauthorized actions within the WordPress environment.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to perform actions on behalf of privileged users, including administrators. This can lead to full site compromise, unauthorized administrative actions, redirection of users to malicious domains, or the theft of sensitive session cookies. Organizations utilizing this plugin for public-facing forms are at high risk of exploitation from external threats.

Recommendation

Prioritized actions for security teams:

  • Update the FormGent plugin to the latest version (v1.9.3 or higher) immediately to ensure proper input sanitization is applied.
  • Review WordPress administrative logs for suspicious modifications performed by non-administrator accounts.
  • Deploy the WAF rule below to detect and block malicious script injection attempts targeting the plugin's submission endpoint.
]]>highadvisoryweb-application-vulnerabilitywordpressxss