Vulnerabilities / Forms / WPSEC-2026-0102
Forms <= 3.0.1 - Reflected Cross-Site Scripting via Form Field Parameters
Medium 6.1
CWE-79Fixed in 3.0.2
- ID
- WPSEC-2026-0102
- Plugin
- Forms (forms-by-made-it)
- Affected
- from 2.8.1 before 3.0.2
- Remediation
- Update to 3.0.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Forms on WPSec AttackSurface
- Fix released
- Published
Description
The forms-by-made-it plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions 2.8.1 up to, and including, 3.0.1 due to insufficient output escaping when block-based forms pre-fill text and textarea fields from GET or POST parameters named after the field. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
References
- https://wpsec.com/vuln/WPSEC-2026-0102/
- https://plugins.svn.wordpress.org/forms-by-made-it/tags/3.0.2/
- https://wordpress.org/plugins/forms-by-made-it/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS