Executive brief
CformsII is a WordPress plugin used to create and manage contact forms. A security vulnerability allows attackers to inject malicious scripts into the website, which could lead to unauthorized redirects, the display of fraudulent advertisements, or the theft of session information from visiting users. This attack can be performed by someone without an account on the site, though it requires a user to interact with a malicious link or page.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the CformsII plugin for WordPress (versions <= 15.1.3) due to improper neutralization of input during web page generation (CWE-79). The vulnerability is unauthenticated, meaning an attacker does not need a valid account to initiate the attack. However, exploitation requires user interaction (UI:R), such as a privileged user clicking a specially crafted link. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking or site defacement. The issue is resolved in version 15.1.4.
Affected products
- CformsII CformsII <= 15.1.3
Timeline
- 2026-03-22: other: Reported by Ilay Striechman
- 2026-06-01: advisory: Patchstack advisory published
- 2026-06-15: disclosed: NVD publication date