Stored Cross-Site Scripting in Smart Forms Plugin for WordPress
CVE-2026-95816

7.2HIGH

Key Information:

Vendor

WordPress
Status
Smart Forms – When You Need More Than Just A Contact Form
Vendor
CVE Published:
14 October 2026

What is CVE-2026-95816?

The Smart Forms plugin for WordPress allows stored cross-site scripting vulnerabilities due to inadequate input sanitization and output escaping in the 'formString' parameter. Unauthenticated attackers can exploit this flaw in all versions up to and including 2.6.104, enabling them to inject code that runs on a user's browser when they visit an affected page. Furthermore, the lack of nonce verification in default settings facilitates this risk, as submission of potentially harmful payloads can occur without any authentication.

Affected Version(s)

Smart Forms – when you need more than just a contact form 0 <= 2.6.104

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/smart-forms/tr...
https://plugins.trac.wordpress.org/browser/smart-forms/tr...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

thevietronin
.