PatchSiren cyber security CVE debrief
CVE-2026-18409 WPForms CVE debrief
The WPForms Pro plugin for WordPress, versions up to and including 2.0.0.2, is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values. This vulnerability exists due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. The exploit relies on the plugin's own wp_kses_allowed_html filter widening the 'post' allowlist to permit iframe elements with a data-src attribute. This vulnerability has a CVSS score of 7.2 and is classified as HIGH. WordPress administrators and users of the WPForms Pro plugin should patch and monitor their installations. Security teams should review logs for suspicious activity and verify patch deployment. Vulnerability management teams should prioritize patching and monitor for abnormal user behavior. The CVE record was published on 2026-08-21T04:18:01.380Z and has not been modified since then. The NVD entry is currently Received.
- Vendor
- WPForms
- Product
- WPForms Pro
- CVSS
- HIGH 7.2
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-21
- Original CVE updated
- 2026-08-21
- Advisory published
- 2026-08-21
- Advisory updated
- 2026-08-21
Who should care
WordPress administrators and users of the WPForms Pro plugin, especially those with versions up to 2.0.0.2, should patch and monitor their installations. Security teams should review logs for suspicious activity and verify patch deployment. Vulnerability management teams should prioritize patching and monitor for abnormal user behavior. Additionally, operators of WordPress platforms and security teams responsible for vulnerability management should be aware of the potential impact of this vulnerability on their systems.
Technical summary
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2. The vulnerability exists due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. The exploit relies on the plugin's own wp_kses_allowed_html filter widening the 'post' allowlist to permit iframe elements with a data-src attribute, which is not on WordPress's URI-attribute sanitization list, allowing a javascript: URI stored in data-src to survive kses processing and subsequently be promoted to a live src attribute by the bundled admin script view-entry.min.js. This vulnerability has a CVSS score of 7.2 and is classified as HIGH.
Defensive priority
Patch and inventory vulnerable WPForms Pro plugin versions up to 2.0.0.2; monitor for suspicious iframe elements with data-src attributes.
Recommended defensive actions
- Patch WPForms Pro plugin versions up to 2.0.0.2
- Inventory and monitor WPForms Pro plugin usage
- Implement additional input sanitization and output escaping measures
- Review logs for suspicious iframe elements with data-src attributes
- Verify patch deployment and monitor for abnormal user behavior
- Conduct a thorough review of the plugin's codebase to identify potential vulnerabilities
- Implement compensating controls for exposed systems while remediation is scheduled and verified
Evidence notes
The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. Limited information available on exploit activity. Defenders should verify patch deployment, review logs for suspicious iframe elements, and monitor for abnormal user behavior.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-21T04:18:01.380Z and has not been modified since then.