Description

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Field Value in all versions up to, and including, 2.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-25T08:16:42.047Z",
  "pubdate": "2026-09-25T08:16:42.047Z",
  "executiveSummary": "The Repeater Fields for Elementor Forms plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This flaw exists in versions 2.2.7 and below.\nThe vulnerability arises from improper sanitization of user-supplied data within the repeater field values before they are stored and subsequently rendered in the administrative or public interface.\nUnauthenticated attackers can inject malicious JavaScript payloads, which will be stored in the database. These scripts execute in the context of the victim's browser whenever they interact with the affected page.\nSuccessful exploitation allows attackers to perform unauthorized actions, hijack administrative sessions, steal sensitive cookies, or redirect users to malicious domains.\nThe risk is critical due to the potential for full administrative account takeover if an administrator views the injected content. The vulnerability does not require authentication to trigger the initial injection, significantly lowering the barrier for exploitation.",
  "technicalDetails": "The vulnerability is identified as a Stored Cross-Site Scripting flaw originating from the lack of rigorous input validation and output encoding within the 'Repeater Fields for Elementor Forms' plugin.\nThe root cause lies in the plugin's failure to sanitize user-provided content submitted through form repeater fields. When these fields are processed, the plugin stores the raw input directly into the WordPress database without applying appropriate filtering mechanisms, such as 'sanitize_text_field' or 'esc_html'.\nUpon rendering these stored values in the WordPress dashboard or on front-end pages, the plugin fails to perform context-aware output escaping. Consequently, any injected HTML or JavaScript tags are interpreted and executed by the victim's browser as legitimate elements of the page.\nThe attack flow proceeds as follows: First, an unauthenticated attacker submits a specially crafted form entry containing malicious JavaScript payloads within the repeater field parameters. Second, the plugin backend accepts this input and persists it into the database. Third, when a legitimate user, such as an administrator, accesses the form submission dashboard or the public page where the repeater data is dynamically rendered, the browser parses the malicious script stored in the database.\nThe payload executes automatically within the user's browser session. Since the context is the WordPress site's domain, the script inherits the user's session privileges. This facilitates a wide array of post-exploitation activities, including but not limited to: stealing authentication cookies, altering the site's DOM to present phishing forms, capturing sensitive user input, or forcing administrative actions such as creating new rogue user accounts or modifying existing site configurations.\nBecause the vulnerability is triggered during the rendering process, the threat persists until the database entry is manually purged or the application is updated. The lack of authentication requirements allows remote, unauthenticated threat actors to target the site directly, posing a severe risk to the integrity and security of the WordPress installation and its users."
}