Executive brief
The Form Vibes plugin for WordPress, which is used to save and manage form submissions, contains a security flaw that allows attackers to inject malicious scripts into the website. An unauthenticated attacker can submit a specially crafted form entry that, when viewed by a site administrator, executes code in their browser. This could lead to unauthorized actions being performed on behalf of the administrator or the theft of sensitive session information.
Technical details
The Form Vibes plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping on form fields integrated with Contact Form 7. The vulnerability exists in versions up to and including 1.5.2. An unauthenticated attacker can exploit this by submitting malicious JavaScript through a Contact Form 7 field, which is then stored in the database by Form Vibes. When an administrative user views the submission within the WordPress dashboard, the script executes in the context of their session. This is a high-severity issue as it requires no authentication and can lead to privilege escalation or session hijacking. A patch appears to be available in versions following 1.5.2.
Affected products
- wpvibes Form Vibes – Database Manager for Forms up to, and including, 1.5.2
Timeline
- 2026-07-11: advisory: NVD publication date
References
- https://plugins.trac.wordpress.org/browser/form-vibes/tags/1.5.2/assets/dist/js/submission.js
- https://plugins.trac.wordpress.org/browser/form-vibes/tags/1.5.2/inc/integrations/base.php
- https://plugins.trac.wordpress.org/browser/form-vibes/tags/1.5.2/inc/integrations/cf7.php
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3599917%40form-vibes&new=3597349%40form-vibes
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c6716a5d-48ed-4735-b765-a7606ea401d0?source=cve