CVE-2026-101921 smub CVE debrief

Who should care

WordPress administrators and users of the WPForms plugin should assess their exposure and take necessary actions to prevent exploitation. This includes verifying WPForms installations, reviewing user-input data, and implementing additional security measures to prevent cross-site scripting attacks. Security teams should prioritize verifying and updating WPForms installations to prevent exploitation and review user-input data to prevent cross-site scripting.

Why it matters

CVE-2026-101921 is a reflected cross-site scripting vulnerability in WPForms that allows unauthenticated attackers to inject arbitrary web scripts. Defenders should prioritize verifying and updating WPForms installations and review user-input data to prevent exploitation.

• Attackers may inject malicious scripts, potentially leading to user exploitation
• Successful exploitation requires user interaction, such as clicking a link
• Verify and update WPForms installations to prevent exploitation
• Review and sanitize user-input data in WPForms to prevent cross-site scripting

Technical summary

The WPForms plugin for WordPress is vulnerable to reflected cross-site scripting via the 'query_var' Smart Tag in an iframe srcdoc attribute. This allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is caused by insufficient input sanitization and output escaping in the WPForms plugin. Exploitation requires a site administrator to have previously saved a form with a {query_var} Smart Tag inside an iframe srcdoc attribute and enabled Show Description on a public-facing page. WPForms plugin users should review compensating controls for exposed systems while remediation

Defensive priority

Defenders should prioritize verifying and updating WPForms installations to prevent exploitation.

Recommended defensive actions

• Verify WPForms version and update to a patched version if necessary
• Review and sanitize user-input data in WPForms
• Implement additional security measures to prevent cross-site scripting attacks
• Confirm whether affected WPForms product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by insufficient input sanitization and output escaping in the WPForms plugin. Exploitation requires a site administrator to have previously saved a form with a {query_var} Smart Tag inside an iframe srcdoc attribute and enabled Show Description on a public-facing page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.