Stored Cross-Site Scripting in Elementor Forms Plugin for WordPress
CVE-2026-94573

7.2HIGH

Key Information:

Vendor

WordPress
Status
Repeater Fields For Elementor Forms
Vendor
CVE Published:
25 September 2026

What is CVE-2026-94573?

The Repeater Fields for Elementor Forms plugin for WordPress contains a vulnerability that allows unauthenticated attackers to execute arbitrary web scripts. This security flaw arises from inadequate sanitization of input fields and improper escaping of output data within the plugin. Attackers can exploit this weakness to inject malicious scripts that execute when users access affected pages, increasing the risk of data theft and website compromise.

Affected Version(s)

Repeater Fields for Elementor Forms 0 <= 2.2.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/repeater-for-e...
https://plugins.trac.wordpress.org/browser/repeater-for-e...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nthng
.