Vendor

Loopus

1 brief RSS

CVE-2026-9253: WordPress E&P Forms Plugin Stored Cross-Site Scripting

An unauthenticated attacker can inject arbitrary web scripts into WordPress sites running the 'WP Cost Estimation & Payment Forms Builder' plugin version 10.5.97 and earlier by exploiting CVE-2026-9253, a Stored Cross-Site Scripting vulnerability via the 'customerInfos' parameter, leading to script execution in users' browsers and potential session hijacking or data theft.

WP Cost Estimation & Payment Forms Builder wordpress xss web-vulnerability plugin

2t 1c 1h ago