Is CVE-2026-18409 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18409 being exploited in the wild.

How severe is CVE-2026-18409?

High severity, with a CVSS score of 7.2, published 21 August 2026.

Which products and versions are affected?

WPForms Pro up to and including 2.0.0.2.

Is there a fix for CVE-2026-18409?

A patch was published on 2026-09-23: Fixed in version 2.0.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18409 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-18409?

Check whether you run WPForms Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18409: WPForms Pro stored cross-site scripting in form field values

CVE-2026-18409 · Severity: high · CVSS 7.2 · Published 2026-08-21

WPForms Pro is a popular WordPress form-building plugin used to create contact forms, surveys, and data collection forms on websites. A stored cross-site scripting vulnerability in form field values allows unauthenticated attackers to inject malicious scripts that execute when site administrators or users view form entries. This could lead to account compromise, credential theft, or malware distribution targeting site administrators.

Vendors: WPForms.

Quick answers

Is CVE-2026-18409 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18409 being exploited in the wild.
How severe is CVE-2026-18409?: High severity, with a CVSS score of 7.2, published 21 August 2026.
Which products and versions are affected?: WPForms Pro up to and including 2.0.0.2.
Is there a fix for CVE-2026-18409?: A patch was published on 2026-09-23: Fixed in version 2.0.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18409 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-18409?: Check whether you run WPForms Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in WPForms Pro versions up to 2.0.0.2, arising from insufficient input sanitization and output escaping of Single Line Text and Paragraph Text field values. The root cause involves the plugin's wp_kses_allowed_html filter that permits iframe elements with data-src attributes, which fall outside WordPress's URI-attribute sanitization list. This allows JavaScript URIs (javascript:) stored in data-src attributes to bypass kses processing and subsequently be promoted to live src attributes by the bundled view-entry.min.js admin script. Attackers can inject arbitrary web scripts by submitting malicious form data; the scripts execute whenever an authenticated user (such as an administrator) accesses the injected entry. The attack requires no authentication to submit the malicious form but impacts authorized users viewing entries. A patch is available in version 2.0.2.1 (released 2026-09-23).

Affected products

WPForms WPForms Pro up to and including 2.0.0.2

Timeline

2026-08-21: disclosed
2026-09-23: patched: Fixed in version 2.0.2.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.