{"schemaVersion":3,"id":"CVE-2026-86799","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.","dates":{"published":"2026-10-14T06:00:13.586Z","modified":"2026-10-14T13:42:21.397Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00375,"percentile":0.30038,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-14T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00375,"percentile":0.30038}],"last30":[{"date":"2026-10-14T00:00:00.000Z","score":0.0021,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00375,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00375,"percentile":0.30038}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_9072791351061C24","name":"Exploit Reference (wpscan.com)","source":"reference","url":"https://wpscan.com/vulnerability/75bdda94-06b3-4747-bcd2-903167ac1c00/","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"unknown","product":"forms","name":"Forms","label":"forms","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 3.0.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.2","eol":null,"hubHref":"/vendor/unknown/forms"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://wpscan.com/vulnerability/75bdda94-06b3-4747-bcd2-903167ac1c00/","label":"wpscan.com/vulnerability/75bdda94-06b3-4747-bcd2-903167ac1c00/","hostname":"wpscan.com","tags":["Exploit","VDB Entry","Technical Description"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-14T06:00:13.586Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-14T13:42:21.397Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":45,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T18:46:40.376Z","stale":false,"partial":false}}