Stored Cross-Site Scripting Vulnerability in WPForms Plugin by WordPress

CVE-2026-15782

What is CVE-2026-15782?

The WPForms – AI Form Builder for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping when integrating with OptinMonster. This allows authenticated users with contributor-level access or higher to inject malicious scripts into pages. These scripts execute whenever a user views the compromised page. Exploitation of this vulnerability necessitates that the OptinMonster plugin is both installed and properly configured with an active inline campaign that triggers specific markup on the affected page. As a result, it poses a significant risk to the security of web applications using this form builder plugin in conjunction with OptinMonster.

References