Cross-Site Scripting Vulnerability in Awesomemotive Contact Form by WPForms
CVE-2026-54851

7.1HIGH

Key Information:

Vendor

WordPress
Status
Contact Form By WPforms
Vendor
CVE Published:
4 November 2026

What is CVE-2026-54851?

A Cross-Site Scripting (XSS) vulnerability exists in the Awesomemotive Contact Form by WPForms (wpforms-lite), which can lead to reflected XSS. This flaw allows malicious users to inject harmful scripts through web page inputs, potentially compromising user data and sessions. The affected versions range from unspecified to 2.0.3, highlighting a critical need for updates to mitigate these risks.

Affected Version(s)

Contact Form by WPForms 0 <= 2.0.3

References

https://patchstack.com/database/wordpress/plugin/wpforms-...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

jydae | Patchstack Bug Bounty Program
.