Form Block <= 1.8.1 - Unauthenticated Stored Cross-Site Scripting via Form Submission Data
- ID
- WPSEC-2026-0382
- Plugin
- Form Block (form-block)
- Affected
- from 1.6.0 before 1.8.2
- Remediation
- Update to 1.8.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- Form Block on WPSec AttackSurface
- Fix released
- Published
Description
The Form Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via submitted form data in versions 1.6.0 up to, and including, 1.8.1 due to insufficient input sanitization of nested field keys and missing output escaping when submissions are displayed in the backend form submission list (Tools > Form Submissions). Keys submitted for array-type fields, such as checkbox groups or repeaters, were stored without sanitization and rendered as field labels without escaping; in versions 1.8.0 and 1.8.1 the unsanitized values stored under such keys were kept as well. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through a form submission that will execute whenever an administrator views the submitted data in the backend.
References
- https://wpsec.com/vuln/WPSEC-2026-0382/
- https://plugins.svn.wordpress.org/form-block/tags/1.8.2/
- https://wordpress.org/plugins/form-block/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS