CVE-2026-18409: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WPForms WPForms Pro

CVE-2026-18409 describes a stored Cross-Site Scripting vulnerability in WPForms Pro for WordPress, affecting all versions up to and including 2.0.0.2. The vulnerability is due to improper neutralization of input during web page generation (CWE-79). Specifically, the plugin's wp_kses_allowed_html filter expands the allowed HTML tags to include iframe elements with a data-src attribute, which is not sanitized against javascript: URIs. This allows an attacker to inject a javascript: URI that survives sanitization and is later promoted to a live src attribute by the plugin's admin script view-entry.min.js, enabling script execution in the context of users viewing the affected pages. The vulnerability requires no privileges or user interaction to exploit and has a CVSS 3.1 base score of 7.2 (high severity).

An unauthenticated attacker can inject arbitrary web scripts into pages generated by WPForms Pro, which execute when users access those pages. This can lead to partial confidentiality and integrity loss (e.g., theft of session tokens or manipulation of page content) but does not affect availability. The vulnerability affects all users who view the injected content, potentially compromising their accounts or data.

No official patch or fix is currently documented for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or restricting access to affected WPForms Pro versions (<=2.0.0.2) and avoid using Single Line Text and Paragraph Text fields for untrusted input. Monitor vendor channels for updates and apply patches promptly once released.