CVE-2026-101921: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More

CVE-2026-101921 is a reflected cross-site scripting vulnerability (CWE-79) in the WPForms – AI Form Builder for WordPress plugin affecting versions up to 2.0.2.1. The vulnerability occurs due to improper neutralization of input in the 'attacker-chosen key referenced by the smart tag' parameter, which is used in form descriptions embedded inside iframe srcdoc attributes. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user interacts with a crafted link. Successful exploitation requires that a site administrator has saved a form with the vulnerable smart tag and enabled the display of the form description on a public-facing page.

The vulnerability allows an unauthenticated attacker to perform reflected cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of the affected website. This can result in limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. The CVSS 3.1 base score is 4.7 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

No official patch or fix is currently available for this vulnerability. Users should check the vendor's advisory for updates. As a temporary mitigation, avoid enabling the display of form descriptions that embed the vulnerable smart tag on public-facing pages. Administrators should also be cautious about saving forms with descriptions containing untrusted input in smart tags. Monitor vendor channels for forthcoming patches and apply them promptly once released.