Executive brief
Breakdance is a popular visual website builder plugin for WordPress used to design pages and manage forms. A security flaw in how the plugin handles form submissions allows attackers to inject malicious scripts into the website's administrative dashboard. If an administrator views the submitted form data, the script could execute, potentially leading to unauthorized actions or the compromise of the administrative account.
Technical details
The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'fields' parameter in versions up to and including 2.7.1. The root cause is a failure to properly sanitize and escape action context data within the Form Submissions action Details panel in the WordPress Admin interface. An unauthenticated attacker can submit a crafted form containing malicious JavaScript; when an authorized administrator subsequently views that submission's details, the script executes in their browser context. This vulnerability is specifically present when 'Store Submission' is enabled and form actions log request/reponse details. The issue was addressed in version 2.7.2 by implementing proper escaping for action context keys and nested values.
Affected products
- Breakdance Breakdance up to and including 2.7.1
Timeline
- 2026-05-08: patched: Vendor released version 2.7.2 to address the issue.
- 2026-07-16: disclosed: Public disclosure of CVE-2026-7543.