CVE-2026-15782

Name of the Vulnerable Software and Affected Versions WPForms versions prior to 2.0.0.2

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting (XSS). This occurs via the data-sitekey attribute within the OptinMonster Integration in post content, enabling the injection of arbitrary web scripts that execute when a user visits the affected page. Successful exploitation requires the OptinMonster plugin to be installed and configured with an active inline campaign that outputs matching #om-{id} markup, as the WPForms handler triggers only upon the om.Campaign.load event.

Recommendations Update to a version newer than 2.0.0.1.