CVE-2026-88996

Name of the Vulnerable Software and Affected Versions WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More versions prior to 2.0.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS), a technique where malicious scripts are injected into a web page and executed in the victim's browser. This occurs via the page title POST parameter through the {page title} Smart Tag. The issue is exploitable when an administrator configures a confirmation message that places the {page title} Smart Tag within an HTML attribute context, enabling the execution of arbitrary web scripts if a user is tricked into clicking a malicious link.

Recommendations Update WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More to version 2.0.3 or later.