CVE-2026-32532
Stored XSS in ThemeHunk Lead Form Elementor Builder
Publication date: 2026-03-25
Last updated on: 2026-03-25
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| themehunk | contact_form_lead_form_elementor_builder | to 2.0.1 (inc) |
| themehunk | lead_form_builder | to 2.0.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-32532 is a medium severity Cross Site Scripting (XSS) vulnerability found in the WordPress Contact Form & Lead Form Elementor Builder Plugin versions up to and including 2.0.1.
This vulnerability allows attackers to inject malicious scripts, such as redirects, advertisements, or other harmful HTML payloads, which execute when site visitors access the compromised website.
The vulnerability is classified under the OWASP Top 10 category A3: Injection and requires user interaction by a privileged user to be successfully exploited, although the initial attack can be initiated by an unauthenticated user.
How can this vulnerability impact me? :
This vulnerability can lead to attackers executing malicious scripts on your website, which may result in unauthorized redirects, display of unwanted advertisements, or other harmful actions affecting your site visitors.
Such exploitation can compromise the integrity and trustworthiness of your website, potentially leading to loss of user trust, damage to your brand reputation, and exposure to further attacks.
Because exploitation requires interaction by a privileged user, attackers might trick authorized users into triggering the malicious payload, increasing the risk of internal compromise.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying if the WordPress Contact Form & Lead Form Elementor Builder Plugin is installed and running a vulnerable version (up to 2.0.1).
You can check the plugin version on your WordPress site by running commands to list installed plugins and their versions.
- Use WP-CLI command: wp plugin list | grep lead-form-builder
- Check the plugin version in the WordPress admin dashboard under Plugins.
Additionally, monitoring for suspicious script injections or unusual behavior in web forms may indicate exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The primary immediate mitigation step is to update the Contact Form & Lead Form Elementor Builder Plugin to version 2.0.2 or later, where the vulnerability is patched.
Until the update can be applied, you can use Patchstack mitigation rules which can block attacks targeting this vulnerability.
It is also advisable to monitor and restrict privileged user interactions that could trigger exploitation, and review web form inputs for suspicious content.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how the Cross-site Scripting (XSS) vulnerability in the Contact Form & Lead Form Elementor Builder plugin directly affects compliance with common standards and regulations such as GDPR or HIPAA.