CVE-2026-18409

Name of the Vulnerable Software and Affected Versions WPForms Pro versions prior to 2.0.0.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS). This occurs when arbitrary web scripts are injected via Single Line Text and Paragraph Text Field values, which then execute when a user accesses the affected page. The issue stems from the wp kses allowed html filter expanding the 'post' allowlist to permit iframe elements with a data-src attribute. Because data-src is not on the standard WordPress URI-attribute sanitization list, a javascript: URI can bypass processing and be converted into a live src attribute by the view-entry.min.js admin script.

Recommendations Update to a version newer than 2.0.0.2.