{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/wpforms-pro/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-18409"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WPForms Pro"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WPForms"],"content_html":"\u003cp\u003eWPForms Pro, a widely used WordPress form-building plugin, contains a critical Stored Cross-Site Scripting (XSS) vulnerability in versions 2.0.0.2 and earlier. The flaw exists due to insufficient input sanitization and output escaping within the Single Line Text and Paragraph Text fields. An unauthenticated attacker can exploit this by submitting specially crafted input containing iframe elements.\u003c/p\u003e\n\u003cp\u003eThe vulnerability is specifically enabled by the plugin's modification of the \u003ccode\u003ewp_kses_allowed_html\u003c/code\u003e filter. This modification widens the allowlist to permit \u003ccode\u003eiframe\u003c/code\u003e elements with a \u003ccode\u003edata-src\u003c/code\u003e attribute. Since \u003ccode\u003edata-src\u003c/code\u003e is not subject to standard WordPress URI-attribute sanitization, an attacker can store a \u003ccode\u003ejavascript:\u003c/code\u003e URI. When a site administrator views the entry via the bundled \u003ccode\u003eview-entry.min.js\u003c/code\u003e script, the application promotes the \u003ccode\u003edata-src\u003c/code\u003e attribute to a live \u003ccode\u003esrc\u003c/code\u003e attribute, resulting in the execution of arbitrary JavaScript in the context of the administrator's session.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to inject malicious scripts into WordPress site entries. When an administrator views these entries, the script executes, potentially leading to unauthorized administrative actions, account takeover, or the exfiltration of sensitive site data. Given the ubiquity of form plugins, this affects a broad range of WordPress-powered websites.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate WPForms Pro to a version beyond 2.0.0.2 immediately to receive the corrected sanitization logic.\u003c/li\u003e\n\u003cli\u003eReview administrative access logs for unusual patterns or activity originating from the plugin's entry view interface.\u003c/li\u003e\n\u003cli\u003eAudit existing form entries for anomalous iframe or script tags if the plugin cannot be updated immediately.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-21T05:22:11Z","date_published":"2026-08-21T05:22:11Z","id":"https://feed.craftedsignal.io/briefs/2026-08-wpforms-xss/","summary":"WPForms Pro versions up to 2.0.0.2 are vulnerable to unauthenticated Stored Cross-Site Scripting via improper input sanitization in text fields.","title":"Stored XSS in WPForms Pro Plugin","url":"https://feed.craftedsignal.io/briefs/2026-08-wpforms-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - WPForms Pro","version":"https://jsonfeed.org/version/1.1"}