Executive brief
WPZOOM Forms is a contact form plugin for WordPress's Gutenberg block editor. A Cross-Site Scripting (XSS) vulnerability in versions 2.0.7 and earlier allows contributors with plugin access to inject malicious scripts into the site. If exploited, attackers could steal visitor data, hijack user accounts, or compromise site functionality.
Technical details
The vulnerability is a stored Cross-Site Scripting (XSS) flaw in WPZOOM Forms Contact Form Plugin for Gutenberg affecting versions up to 2.0.7. The vulnerability requires contributor-level or higher privilege to initiate, meaning an authenticated user with plugin management or form editing permissions must perform a malicious action (such as submitting a crafted form or clicking a malicious link). An attacker exploiting this flaw can inject arbitrary JavaScript code into the site, leading to theft of visitor data, session hijacking, or account takeover. The vulnerability has been patched in version 2.0.8 and later; users should update immediately.
Affected products
- WPZOOM Forms – Contact Form Plugin for Gutenberg <=2.0.7
Timeline
- 2026-07-09: disclosed: Vulnerability reported to Patchstack
- 2026-08-18: advisory: Vulnerability published by Patchstack
- 2026-08-18: patched: Patched in version 2.0.8