01 Record

CVE-2026-18409

WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values

HighPUBLISHEDCNA: Wordfence

Base score7.2 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

02 Description

WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values

Published

2026-08-21 03:37Z21 HR AGO

Last updated

2026-08-21 15:26Z10 HR AGO

Reserved

2026-07-30

Assigning CNA

Wordfence

Record state

PUBLISHED

Severity

High (CVSS 7.2)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weaknesses

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Base

SSVC decision

ExploitationnoneAutomatableyesTechnical Impactpartial

Data version

5.2

Document digest

58a752e56bc34d9567b60c243f1b30d5000a99457260cdb2ad1b4909486ab2bb

VendorProductVersionsPlatforms

WPFormsWPForms Pro0 to 2.0.0.2—

01 Record