Compliance Impact

The provided information does not specify how the Cross-site Scripting (XSS) vulnerability in the Contact Form & Lead Form Elementor Builder plugin directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-32532 is a medium severity Cross Site Scripting (XSS) vulnerability found in the WordPress Contact Form & Lead Form Elementor Builder Plugin versions up to and including 2.0.1.

This vulnerability allows attackers to inject malicious scripts, such as redirects, advertisements, or other harmful HTML payloads, which execute when site visitors access the compromised website.

The vulnerability is classified under the OWASP Top 10 category A3: Injection and requires user interaction by a privileged user to be successfully exploited, although the initial attack can be initiated by an unauthenticated user.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to attackers executing malicious scripts on your website, which may result in unauthorized redirects, display of unwanted advertisements, or other harmful actions affecting your site visitors.

Such exploitation can compromise the integrity and trustworthiness of your website, potentially leading to loss of user trust, damage to your brand reputation, and exposure to further attacks.

Because exploitation requires interaction by a privileged user, attackers might trick authorized users into triggering the malicious payload, increasing the risk of internal compromise.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if the WordPress Contact Form & Lead Form Elementor Builder Plugin is installed and running a vulnerable version (up to 2.0.1).

You can check the plugin version on your WordPress site by running commands to list installed plugins and their versions.

• Use WP-CLI command: wp plugin list | grep lead-form-builder
• Check the plugin version in the WordPress admin dashboard under Plugins.

Additionally, monitoring for suspicious script injections or unusual behavior in web forms may indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary immediate mitigation step is to update the Contact Form & Lead Form Elementor Builder Plugin to version 2.0.2 or later, where the vulnerability is patched.

Until the update can be applied, you can use Patchstack mitigation rules which can block attacks targeting this vulnerability.

It is also advisable to monitor and restrict privileged user interactions that could trigger exploitation, and review web form inputs for suspicious content.

Useful 0 Not Useful 0