Description

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'page_title' POST Parameter via {page_title} Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on forms whose admin-authored confirmation message places the {page_title} Smart Tag inside an HTML attribute context.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-25T08:16:40.670Z",
  "pubdate": "2026-09-25T08:16:40.670Z",
  "executiveSummary": "The WPForms WordPress plugin, in all versions up to and including 2.0.2, is susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability.\nThis security flaw stems from inadequate input sanitization and output escaping of the 'page_title' POST parameter when processed via the {page_title} Smart Tag.\nThe vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the context of the victim's browser session.\nSuccessful exploitation requires an attacker to trick a targeted user into performing a specific action, such as clicking a malicious link, while the victim is interacting with a form configured to display the {page_title} Smart Tag within an HTML attribute.\nThe impact includes potential unauthorized access to session tokens, data theft, and the performance of administrative actions on behalf of the victim. Because this vulnerability is exploitable by unauthenticated actors, it represents a significant security risk to sites utilizing these specific form configurations.",
  "technicalDetails": "The vulnerability exists within the handling of the {page_title} Smart Tag, which fails to implement robust input sanitization or context-aware output escaping. The root cause is the improper handling of the 'page_title' POST parameter, which is reflected back to the client side without sufficient encoding when rendered by the Smart Tag logic.\nExploitation is contingent upon the site administrator configuring a form's confirmation message to include the {page_title} Smart Tag within an HTML attribute context (e.g., <input value='{page_title}'>). By manipulating the 'page_title' parameter during the form submission process, an attacker can break out of the HTML attribute context by injecting payload sequences such as ' onmouseover='alert(1)'.\nThe attack flow initiates when an unauthenticated actor crafts a malicious request containing a payload designed to escape the attribute container. Once the user is tricked into interacting with a crafted link or triggering a form submission that reflects the malicious input, the application renders the unsanitized payload into the DOM of the victim's browser.\nBecause the payload is injected into an HTML attribute context, standard browser XSS auditors may be bypassed if they do not sufficiently validate the attribute's syntax. Upon rendering, the malicious script executes within the security origin of the WordPress site. This allows the attacker to access sensitive information stored in the browser, such as document cookies (session identifiers), perform unauthorized requests on behalf of the authenticated user, or redirect users to malicious domains.\nThe scope of this vulnerability is limited to forms where the aforementioned {page_title} Smart Tag is specifically positioned within an HTML attribute. This requirement creates a dependency on the specific configuration of the form's confirmation display, but since the vulnerability originates from the plugin's underlying parsing logic for the Smart Tag, it remains a critical issue for any form relying on this dynamic content feature across all affected versions up to 2.0.2. The lack of output encoding ensures that any JavaScript payload injected into the 'page_title' parameter is interpreted as executable code rather than plain text by the browser's rendering engine."
}