CVE-2026-95816: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in edgarrojas Smart Forms – when you need more than just a contact form

CVE-2026-95816 describes a stored Cross-Site Scripting vulnerability in the Smart Forms plugin for WordPress by edgarrojas. The vulnerability exists in all versions up to and including 2.6.104 and is caused by improper neutralization of input during web page generation, specifically via the 'formString' parameter. The plugin fails to properly sanitize and escape input, allowing unauthenticated attackers to inject arbitrary scripts that execute in the context of users visiting the injected pages. Additionally, the nonce check on the AJAX handler 'rednao_smart_forms_save_form_values' is only enforced if the 'smart_forms_block_anonymous_submissions' option is enabled. By default, this means no authentication or nonce verification is required to submit and store malicious payloads, increasing the attack surface.

An attacker can inject persistent malicious scripts into pages generated by the Smart Forms plugin, which will execute in the browsers of users who visit those pages. This can lead to theft of user credentials, session hijacking, or other actions performed with the user's privileges. The vulnerability is exploitable remotely without authentication, increasing risk. The CVSS 3.1 score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and partial confidentiality and integrity impact with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider enabling the 'smart_forms_block_anonymous_submissions' option to enforce nonce checks on the AJAX handler, which can reduce risk by requiring verification before form submissions are accepted. Additionally, monitoring for suspicious form submissions and restricting access to form management interfaces may help mitigate exploitation.