Executive brief
WPForms Pro is a popular WordPress form-building plugin used to create contact forms, surveys, and data collection forms on websites. A stored cross-site scripting vulnerability in form field values allows unauthenticated attackers to inject malicious scripts that execute when site administrators or users view form entries. This could lead to account compromise, credential theft, or malware distribution targeting site administrators.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in WPForms Pro versions up to 2.0.0.2, arising from insufficient input sanitization and output escaping of Single Line Text and Paragraph Text field values. The root cause involves the plugin's wp_kses_allowed_html filter that permits iframe elements with data-src attributes, which fall outside WordPress's URI-attribute sanitization list. This allows JavaScript URIs (javascript:) stored in data-src attributes to bypass kses processing and subsequently be promoted to live src attributes by the bundled view-entry.min.js admin script. Attackers can inject arbitrary web scripts by submitting malicious form data; the scripts execute whenever an authenticated user (such as an administrator) accesses the injected entry. The attack requires no authentication to submit the malicious form but impacts authorized users viewing entries. A patch is available in version 2.0.2.1 (released 2026-09-23).
Affected products
- WPForms WPForms Pro up to and including 2.0.0.2
Timeline
- 2026-08-21: disclosed
- 2026-09-23: patched: Fixed in version 2.0.2.1