Stored Cross-Site Scripting Vulnerability in BuddyForms Plugin for WordPress

CVE-2026-107658

What is CVE-2026-107658?

The BuddyForms plugin for WordPress has a vulnerability that allows Stored Cross-Site Scripting through insufficient input sanitization and output escaping in its 'bf_post_type' and 'buddyforms_form_content' parameters. This flaw permits unauthenticated attackers to inject arbitrary web scripts. To exploit this vulnerability, the site must have at least one BuddyForms form with public submissions enabled, allowing attackers to harvest the required nonce from the public form page. Additionally, the active theme must register a widgetized sidebar, enabling the injected malicious scripts to render on the site's front end as Custom HTML widgets.

References