DOM-Based Cross-Site Scripting in Cool FormKit Lite for Elementor Plugin
CVE-2026-118500

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
Cool Formkit Lite – Advanced Form Builder For Elementor
Vendor
CVE Published:
30 October 2026

What is CVE-2026-118500?

The Cool FormKit Lite plugin for Elementor is exposed to stored DOM-based cross-site scripting due to inadequate input sanitization and output escaping. Authenticated users with contributor-level access can exploit the '_elementor_data.form_fields[].custom_id' parameter to inject malicious scripts. These scripts may execute whenever a user visits an affected page. The vulnerability arises from the failure of the esc_html() function to effectively prevent HTML injection, allowing crafted inputs to break out of HTML attribute contexts within the plugin's frontend scripts. Users should ensure they are using an updated version of the plugin to mitigate this issue.

Affected Version(s)

Cool FormKit Lite – Advanced Form Builder for Elementor 0 <= 2.7.9

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/extensions-for...
https://plugins.trac.wordpress.org/browser/extensions-for...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.