Stored Cross-Site Scripting Vulnerability in BuddyForms Plugin by Themekraft
CVE-2026-127115

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Buddyforms
Vendor
CVE Published:
14 November 2026

What is CVE-2026-127115?

The BuddyForms plugin for WordPress is affected by a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping in the 'buddyforms_form_content' parameter. This issue allows unauthenticated attackers to inject arbitrary web scripts into the affected pages. Exploitation is possible when forms are published with the public_submit option, such as the default Post Simple template. Users accessing these compromised pages may inadvertently execute the injected scripts, leading to potential unauthorized actions and data exposure.

Affected Version(s)

BuddyForms 0 <= 2.10.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/buddyforms/tag...
https://plugins.trac.wordpress.org/browser/buddyforms/tag...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohamed Amgad Khater (mamgad)
.