Vulnerabilities / Forms / WPSEC-2026-0100
Forms <= 3.0.1 - Unauthenticated Stored Cross-Site Scripting via Form Submission Values
High 7.2
CWE-79Fixed in 3.0.2
- ID
- WPSEC-2026-0100
- Plugin
- Forms (forms-by-made-it)
- Affected
- from 2.0.1 before 3.0.2
- Remediation
- Update to 3.0.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Forms on WPSec AttackSurface
- Fix released
- Published
Description
The forms-by-made-it plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission values in versions 2.0.1 up to, and including, 3.0.1 due to missing output escaping in the 'Field' columns of the admin Submitted forms list, which echoed stored submission values (including array values) unescaped. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through a public form that will execute whenever an administrator views the submissions list.
References
- https://wpsec.com/vuln/WPSEC-2026-0100/
- https://plugins.svn.wordpress.org/forms-by-made-it/tags/3.0.2/
- https://wordpress.org/plugins/forms-by-made-it/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS