CVE-2026-95816

Name of the Vulnerable Software and Affected Versions The Smart Forms – when you need more than just a contact form plugin for WordPress versions prior to 2.6.105

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. This occurs via the formString parameter. The rednao smart forms save form values AJAX handler only enforces a nonce check—a security token used to prevent request forgery—when the smart forms block anonymous submissions option is enabled. Consequently, default installations allow the submission and storage of malicious payloads without authentication or nonce verification, which execute when a user accesses the affected page.

Recommendations Update to a version newer than 2.6.104. Enable the smart forms block anonymous submissions option to enforce nonce verification for the rednao smart forms save form values AJAX handler.