Forms WordPress plugin: Unauthenticated stored XSS via form submissions
Summary
Versions of the Forms WordPress plugin before 3.0.2 do not sanitise submitted form values or escape them on the submissions screen in the admin dashboard. An unauthenticated visitor can submit a form containing a script that runs in the browser of any administrator who opens the submissions. The attack needs no login, but it depends on an administrator viewing the stored submissions.
Affected
- Forms (WordPress plugin), all versions before 3.0.2 (per CVE record)
- The exact plugin identity is unverified: the CNA lists vendor 'Unknown' and product 'Forms'.
Fixed in
- Version 3.0.2 (per CVE description). No vendor advisory confirming the fix was found.
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- Scores differ across sources: NVD 8.8, VulDB 4.3.
Our recommendation
- Update the Forms plugin to version 3.0.2 or later if it is installed, prioritising public-facing sites.
- Until the update is applied, limit who can log in to the WordPress admin area and avoid opening submission data as an administrator.
- Review existing form submissions for unexpected script content.
- Check administrator accounts that viewed submissions before patching for unusual activity.
- Consider a strict Content Security Policy as an additional safeguard.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory wpscan.com
- VulDB 419470 vuldb.com
- Vulners CVE list entry vulners.com
- Vulners CIRCL entry vulners.com
- GitHub CVE tracker issue github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:54.
Original description (NVD)
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.