# CVE-2026-15782: WPForms Stored XSS in OptinMonster Integration

Source: https://junglewise.ai/threats/cve-2026-15782-wpforms-stored-xss-in-optinmonster-integration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-21. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-15782 · Severity: medium · CVSS 4.9 · Published 2026-07-21

WPForms is a popular WordPress plugin used to create contact and payment forms. A security flaw allows users with contributor-level access to inject malicious scripts into website pages. If exploited, these scripts could run in the browsers of other visitors, potentially leading to unauthorized actions or data theft, though the attack requires specific integration with the OptinMonster plugin to be active.

Technologies: [WPForms](https://junglewise.ai/threats/technologies/wpforms). Vendors: [WPForms](https://junglewise.ai/threats/vendors/wpforms).

## Quick answers

**Is CVE-2026-15782 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15782 being exploited in the wild.

**How severe is CVE-2026-15782?** Medium severity, with a CVSS score of 4.9, published 21 July 2026.

**Which products and versions are affected?** WPForms up to, and including, 2.0.0.1.

**Is there a fix for CVE-2026-15782?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-15782 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15782?** Check whether you run WPForms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in WPForms due to insufficient input sanitization and output escaping of the 'data-sitekey' attribute within the OptinMonster integration. Authenticated attackers with contributor-level permissions or higher can inject malicious JavaScript into post content. The vulnerability is triggered when the OptinMonster plugin is installed and configured with an active inline campaign that emits the 'om.Campaign.load' event. When this event fires, the WPForms handler processes the malicious attribute, leading to script execution in the context of the victim's browser. The issue is addressed in versions following 2.0.0.1.

## Affected products

- smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More up to, and including, 2.0.0.1

## Timeline

- 2026-07-21: disclosed
- 2026-07-21: advisory

## References

- [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.4/assets/js/frontend/wpforms.min.js](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.0.4/assets/js/frontend/wpforms.min.js)
- [https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.2.1/assets/js/frontend/wpforms.min.js](https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.10.2.1/assets/js/frontend/wpforms.min.js)
- [https://plugins.trac.wordpress.org/changeset/3610719/wpforms-lite/trunk/assets/js/frontend/wpforms.min.js?old=3586095&old_path=wpforms-lite%2Ftrunk%2Fassets%2Fjs%2Ffrontend%2Fwpforms.min.js](https://plugins.trac.wordpress.org/changeset/3610719/wpforms-lite/trunk/assets/js/frontend/wpforms.min.js?old=3586095&old_path=wpforms-lite%2Ftrunk%2Fassets%2Fjs%2Ffrontend%2Fwpforms.min.js)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5264a1-dabf-4630-9871-ab6e14817768?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/6d5264a1-dabf-4630-9871-ab6e14817768?source=cve)

## Related threats

- [WPForms plugin reflected cross-site scripting in smart tags](https://junglewise.ai/threats/cve-2026-101921-the-wpforms-ai-form-builder-for-wordpress-contact-forms-payment)
- [WPForms access control bypass in Stripe payment handling](https://junglewise.ai/threats/cve-2026-74991-the-wpforms-wordpress-plugin-before-2-0-2-does-not-verify-that-a)
- [WPForms CRLF injection in email notifications](https://junglewise.ai/threats/cve-2026-12127-wpforms-crlf-injection-in-email-notifications)
- [WPForms PayPal Commerce webhook data authenticity bypass](https://junglewise.ai/threats/cve-2026-7792-wpforms-paypal-commerce-webhook-data-authenticity-bypass)