CVE-2026-86799
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor…
- Risk score
- 64/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.0.2 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
- Remotely exploitable without logging in
References
Original description
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.
Last activity 14 Oct 2026. Patch Forecast updates every hour.