CVE-2026-86799
Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.
| Vendor | unknown |
| Product | forms |
| Published | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown forms
Be the first to know when new unknown vulnerabilities affecting unknown forms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Forms
0 < 3.0.2
References
Credits
Pablo González Pérez Francisco José Ramírez Vicente and Iñigo Sánchez Enciso WPScan