Description

Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-18T15:16:58.623Z",
  "pubdate": "2026-08-18T15:16:58.623Z",
  "executiveSummary": "An authenticated Cross-Site Scripting (XSS) vulnerability exists in the WPZOOM Forms – Contact Form Plugin for Gutenberg, affecting all versions up to and including 2.0.4. This security flaw arises from insufficient input sanitization and output encoding of user-supplied data within the plugin. An attacker possessing contributor-level privileges or higher can inject malicious scripts, typically JavaScript, into input fields managed by the plugin. When an administrator or another user views the rendered form data or administrative interface, the embedded payload executes within the context of their browser session. The risk implication includes potential session hijacking, unauthorized administrative actions, and the modification of site content. Successful exploitation requires authenticated access with contributor privileges or above, allowing the threat actor to leverage the trust established between the authenticated user and the WordPress application. Mitigating this issue requires updating the affected plugin to a secure version once available or restricting user roles capable of interacting with form creation and management.",
  "technicalDetails": "The vulnerability is classified as a Cross-Site Scripting (XSS) flaw localized within the WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4. The root cause stems from the application accepting unsanitized input from users with contributor capabilities and subsequently rendering this input without proper context-aware output encoding. The vulnerable component involves the internal request handling and data rendering mechanisms responsible for processing form elements and configurations within the Gutenberg block editor interface.\nAuthentication and privilege requirements necessitate that the attacker holds at least a contributor-level role within the WordPress installation. While contributors cannot publish posts directly, the permission boundary is bypassed if the application logic allows them to input or modify data fields processed by the plugin without enforcing strict capability checks or data sanitization routines such as sanitize_text_field or esc_html.\nThe attack flow proceeds as follows: First, the authenticated attacker crafts a malicious HTTP request containing a payload consisting of HTML tags and JavaScript event handlers (e.g., <script> or onload attributes) injected into vulnerable input vectors managed by the plugin. Second, the server accepts the input and persists it within the database without adequate validation or neutralization. Third, when a privileged user, such as an administrator, navigates to the dashboard or page where the stored form data is rendered, the server outputs the raw, unescaped payload back to the browser. Fourth, the victim's browser interprets the response as executable script content, executing the payload within the active session. The post-exploitation impact includes the execution of arbitrary JavaScript in the victim's browser, potentially leading to the theft of session cookies, administrative account takeover, or the injection of secondary malware into the hosting WordPress environment."
}