CVE-2026-15782 is a stored cross-site scripting vulnerability in the WPForms – AI Form Builder for WordPress plugin, specifically via the OptinMonster integration's data-sitekey attribute in post content. The flaw allows authenticated attackers with contributor-level privileges or higher to inject arbitrary scripts into pages. These scripts execute when users access the injected pages, potentially leading to information disclosure or session hijacking. Exploitation depends on the presence and configuration of the OptinMonster plugin with an active inline campaign that emits the 'om.Campaign.load' event, which triggers the vulnerable WPForms handler. The vulnerability is due to insufficient input sanitization and output escaping in all versions up to and including 2.0.0.1.

Successful exploitation allows an authenticated user with contributor-level access or higher to inject and execute arbitrary JavaScript in the context of affected pages. This can lead to limited confidentiality and integrity impacts such as theft of user data or session tokens. The vulnerability does not impact availability. Exploitation requires specific conditions including the presence and configuration of the OptinMonster plugin with an active inline campaign.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users and monitor for suspicious activity related to the OptinMonster integration. Consider disabling or removing the OptinMonster plugin or its inline campaigns if not required, as exploitation depends on its presence and configuration.