Stored Cross-Site Scripting in Forms Bridge Plugin for WordPress

CVE-2026-1244

What is CVE-2026-1244?

The Forms Bridge – Infinite integrations plugin for WordPress has a vulnerability that allows for Stored Cross-Site Scripting through the 'id' shortcode attribute within the 'financoop_campaign' shortcode. This vulnerability arises from inadequate input sanitization and output escaping in the forms_bridge_financoop_shortcode_error function. Authenticated attackers with Contributor-level access or higher can exploit this flaw, injecting malicious web scripts into pages that execute when users access these compromised pages. The vulnerability affects all versions of the plugin up to and including 4.2.5.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References