Is CVE-2026-101921 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101921 being exploited in the wild.

How severe is CVE-2026-101921?

Medium severity, with a CVSS score of 4.7, published 10 October 2026.

Which products and versions are affected?

WPForms up to and including 2.0.2.1.

Is there a fix for CVE-2026-101921?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-101921 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-101921?

Check whether you run WPForms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101921: WPForms plugin reflected cross-site scripting in smart tags

CVE-2026-101921 · Severity: medium · CVSS 4.7 · Published 2026-10-10

WPForms is a WordPress plugin that allows site administrators to create contact forms, payment forms, surveys, and quizzes. The plugin is vulnerable to reflected cross-site scripting (XSS) attacks when a form description contains a smart tag query variable displayed in an iframe. An attacker can craft a malicious link and trick users into clicking it, causing arbitrary scripts to execute in their browsers and potentially steal session data or perform unauthorized actions.

Technologies: WPForms. Vendors: WPForms.

Quick answers

Is CVE-2026-101921 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101921 being exploited in the wild.
How severe is CVE-2026-101921?: Medium severity, with a CVSS score of 4.7, published 10 October 2026.
Which products and versions are affected?: WPForms up to and including 2.0.2.1.
Is there a fix for CVE-2026-101921?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-101921 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-101921?: Check whether you run WPForms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a reflected XSS flaw in the QueryVar smart tag handler due to insufficient input sanitization and output escaping of attacker-controlled query string parameters. The attack requires that a site administrator has previously saved a form with a {query_var} smart tag embedded in an iframe srcdoc attribute and enabled the form description on a public-facing page. Unauthenticated attackers can inject arbitrary HTML and JavaScript by crafting a malicious URL that will execute in the context of the victim's browser session.

Affected products

WPForms WPForms up to and including 2.0.2.1

Timeline

2026-10-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.