CVE-2026-18409 describes a stored cross-site scripting vulnerability in WPForms Pro plugin for WordPress, affecting all versions up to and including 2.0.0.2. The vulnerability is due to improper neutralization of input during web page generation (CWE-79). Specifically, the plugin's wp_kses_allowed_html filter expands the allowed HTML tags to include iframe elements with a data-src attribute. Since data-src is not sanitized against javascript: URIs by WordPress's URI-attribute sanitization, an attacker can store a malicious javascript: URI in data-src. The bundled admin script view-entry.min.js then promotes data-src to a live src attribute, causing the injected script to execute when a user accesses the affected page. The vulnerability requires no privileges or user interaction to inject, but script execution occurs when the page is viewed.

An unauthenticated attacker can inject persistent malicious scripts into pages generated by WPForms Pro, which execute in the context of users viewing those pages. This can lead to information disclosure and integrity impacts (as indicated by the CVSS vector: Confidentiality Low, Integrity Low, Availability None). The vulnerability does not require user interaction to inject but does require a user to view the injected content for exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the affected plugin and monitor for suspicious activity related to form inputs. Avoid using vulnerable versions of WPForms Pro if possible.