CVE-2026-86799

Deferred Deferred - Pending Action

Cross-Site Scripting in Forms WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-86799

EUVD

EUVD-2026-100855

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Forms	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is an unauthenticated stored cross-site scripting (XSS) vulnerability in the WordPress plugin 'Forms' versions before 3.0.2. The plugin fails to sanitize user-submitted form data before storing it and does not escape it when displaying submissions in the admin dashboard. This allows attackers to inject malicious scripts that execute in the browsers of administrators viewing the submissions.

Detection Guidance

Check if the Forms WordPress plugin version is below 3.0.2. Inspect form submissions in the admin dashboard for unusual or unexpected scripts. Look for unauthorized changes in stored form data.

Impact Analysis

Unauthenticated attackers can inject arbitrary web scripts that execute in the browser of any administrator viewing the form submissions. This could lead to unauthorized access, data theft, or further compromise of the WordPress site and its users.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to potential unauthorized access to sensitive form data. Stored XSS may allow attackers to steal or manipulate personal data, violating GDPR's integrity and confidentiality requirements. For HIPAA, unauthorized script execution could expose protected health information (PHI) in WordPress admin dashboards.

Mitigation Strategies

Update the Forms plugin to version 3.0.2 or later immediately. If updating is not possible, consider disabling the plugin until a patch is applied. Monitor admin dashboard for suspicious activity.

Hi! I’m here to help you understand CVE-2026-86799. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70