[ CVE-2026-86799 · Published 14 Oct 2026 ]
Vulnerability in Unknown Forms
CVSS 8.8
EPSS <1%No fix listed yet
[ Description ]Official description
The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.