Description

The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-06T12:16:26.523Z",
  "pubdate": "2026-08-06T12:16:26.523Z",
  "executiveSummary": "The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability via form submission fields in all versions up to, and including, 1.9.2. This security flaw stems from insufficient input sanitization and inadequate output escaping mechanisms implemented within the form submission handling routines.\nThe vulnerability allows unauthenticated remote attackers to inject arbitrary web scripts, such as malicious JavaScript payloads, directly into form submission inputs. These injected payloads are subsequently persisted within the database and rendered back to users or administrative personnel whenever they access the affected administrative or frontend pages where the form entries are displayed.\nSuccessful exploitation of this Stored XSS vulnerability carries significant risk implications, as it enables attackers to execute arbitrary scripts in the context of a victim's browser session. Depending on the privileges of the user viewing the injected page, this can lead to unauthorized actions, session hijacking, credential theft, or further compromise of the WordPress site. The primary requirement for exploitation is network access to the vulnerable WordPress instance and the ability to submit data via the form builder component without requiring prior authentication.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure handling of user-supplied data within the FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin. Specifically, versions up to, and including, 1.9.2 fail to properly sanitize incoming input data received through form submission fields and subsequently fail to apply context-aware output escaping when rendering this data back to the user interface.\nThe vulnerable component consists of the form submission processing module and the corresponding entry viewing interface within the plugin architecture. Because the application accepts arbitrary user input without enforcing strict validation or sanitization routines, malicious payloads containing HTML and JavaScript can be successfully passed through the HTTP request parameters and committed to the database storage layer.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious HTTP request containing arbitrary web scripts within one or more form submission fields provided by the FormGent plugin. Second, the plugin processes the input and stores the raw, unescaped payload directly into the database. Third, at a later time, an authenticated user or administrator navigates to the affected page within the WordPress dashboard or frontend interface where form submissions are listed or reviewed. Fourth, the application retrieves the stored record from the database and renders the input into the Document Object Model (DOM) without proper output escaping. Finally, the browser executes the injected JavaScript in the security context of the victim's session.\nNetwork exposure is fully external, as the form submission functionality is accessible over standard HTTP/HTTPS protocols without authentication requirements. The privilege requirements for initiating the attack are none, allowing unauthenticated threat actors to inject the payloads. However, the ultimate impact and script execution context depend on the privileges of the user who accesses the contaminated page, ranging from standard subscriber privileges to high-privileged administrative access. Post-exploitation impact includes unauthorized session manipulation, defacement, redirection to malicious external resources, or the execution of arbitrary administrative actions via compromised browser sessions."
}