CVE-2026-1454

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1454", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-26T19:59:41.414Z", "datePublished": "2026-03-11T08:24:46.492Z", "dateUpdated": "2026-04-08T17:33:21.106Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:21.106Z"}, "affected": [{"vendor": "themehunk", "product": "Lead Form Builder & Contact Form", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.0.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 via form field submissions. This is due to insufficient input sanitization in the lfb_lead_sanitize() function which omits certain field types from its sanitization whitelist, combined with an overly permissive wp_kses() filter at output time that allows onclick attributes on anchor tags. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the lead entries in the WordPress dashboard."}], "title": "Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f5863132-90a7-414f-abcb-e8b6a9d229c5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lead-form-builder/tags/2.0.1/inc/ajax-functions.php#L587"}, {"url": "https://plugins.trac.wordpress.org/browser/lead-form-builder/tags/2.0.1/inc/show-lead.php#L13"}, {"url": "https://plugins.trac.wordpress.org/changeset/3462549/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 7.2, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Youssef Elouaer"}], "timeline": [{"time": "2026-03-10T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T13:30:45.840229Z", "id": "CVE-2026-1454", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:35:53.834Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1454", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T13:30:45.840229Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:35:49.621Z"}}], "cna": {"title": "Responsive Contact Form Builder & Lead Generation Plugin <= 2.0.1 - Unauthenticated Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Youssef Elouaer"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "themehunk", "product": "Lead Form Builder & Contact Form", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-10T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f5863132-90a7-414f-abcb-e8b6a9d229c5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/lead-form-builder/tags/2.0.1/inc/ajax-functions.php#L587"}, {"url": "https://plugins.trac.wordpress.org/browser/lead-form-builder/tags/2.0.1/inc/show-lead.php#L13"}, {"url": "https://plugins.trac.wordpress.org/changeset/3462549/"}], "descriptions": [{"lang": "en", "value": "The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 via form field submissions. This is due to insufficient input sanitization in the lfb_lead_sanitize() function which omits certain field types from its sanitization whitelist, combined with an overly permissive wp_kses() filter at output time that allows onclick attributes on anchor tags. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the lead entries in the WordPress dashboard."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:33:21.106Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1454", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:33:21.106Z", "dateReserved": "2026-01-26T19:59:41.414Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-11T08:24:46.492Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Lead Form Builder & Contact Form", "vendor": "themehunk", "versions": [{"lessThanOrEqual": "2.0.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 via form field submissions. This is due to insufficient input sanitization in the lfb_lead_sanitize() function which omits certain field types from its sanitization whitelist, combined with an overly permissive wp_kses() filter at output time that allows onclick attributes on anchor tags. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the lead entries in the WordPress dashboard."}, {"lang": "es", "value": "El plugin Responsive Contact Form Builder &amp; Lead Generation Plugin para WordPress es vulnerable a cross-site scripting almacenado en todas las versiones hasta la versi\u00f3n 2.0.1, inclusive, a trav\u00e9s de env\u00edos de campos de formulario. Esto se debe a una sanitizaci\u00f3n de entrada insuficiente en la funci\u00f3n lfb_lead_sanitize() que omite ciertos tipos de campo de su lista blanca de sanitizaci\u00f3n, combinado con un filtro wp_kses() excesivamente permisivo en el momento de la salida que permite atributos onclick en las etiquetas de anclaje. Esto hace posible que atacantes no autenticados inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un administrador vea las entradas de leads en el panel de WordPress."}], "id": "CVE-2026-1454", "lastModified": "2026-06-17T10:15:49.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1454", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T13:30:45.840229Z", "version": "2.0.3"}}]}, "published": "2026-03-11T09:16:12.647", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/lead-form-builder/tags/2.0.1/inc/ajax-functions.php#L587"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/lead-form-builder/tags/2.0.1/inc/show-lead.php#L13"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3462549/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f5863132-90a7-414f-abcb-e8b6a9d229c5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.0.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Lead Form Builder & Contact Form", "source": "cna", "vendor": "themehunk"}, "product": "lead_form_builder_&_contact_form", "vendor": "themehunk"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-17T15:31:43.538104+00:00", "value": {"mitigation_remediation": ["Update the Lead Form Builder & Contact Form plugin to the latest version", "If a patch is not immediately available, temporarily disable or uninstall the plugin to prevent new lead submissions", "Delete any stored lead entries that may contain malicious content to eliminate the XSS vector", "Review wp_kses and other output filtering rules to ensure that dangerous attributes such as onclick are disallowed", "Verify that the site\u2019s security monitoring is enabled to detect unexpected script execution in the admin dashboard"], "summary": {"action": "Patch plugin", "impact": "Stored XSS enabling script execution for administrators"}, "threat_synthesis": {"affected_systems": "All WordPress installations that have the themehunk Lead Form Builder & Contact Form plugin version 2.0.1 or earlier are affected. The weakness spans the entire plugin codebase for these versions; any site that accepts form submissions using this plugin is susceptible to the stored XSS vector.", "description_and_impact": "The Responsive Contact Form Builder & Lead Generation Plugin for WordPress is vulnerable to stored cross\u2011site scripting due to insufficient sanitization in the lfb_lead_sanitize() function and an overly permissive wp_kses() filter that allows onclick attributes on anchor tags. This flaw permits unauthenticated attackers to submit malicious content via a form field, which is then stored in the database. When a site administrator later views the lead entries in the WordPress dashboard, the stored script is rendered and executed in the admin browser context. The vulnerability is a classic input validation/sanitization defect identified as CWE\u201179.", "risk_and_exploitability": "The CVSS score of 7.2 indicates a high severity for confidentiality, integrity, and availability of the administrative session. The EPSS score of less than 1\u202f% suggests a relatively low likelihood of exploitation in the wild at present, and the vulnerability is not listed in the CISA KEV catalog. An attacker only needs an unauthenticated POST to the plugin\u2019s form endpoint; no authentication or privileged access is required. When the stored payload is viewed by an administrator, it executes in their browser, potentially stealing session cookies, defacing the dashboard, or executing arbitrary client\u2011side code."}}}}, "created": "2026-03-12T10:06:11.211702+00:00", "updated": "2026-03-20T14:37:32.253060+00:00", "vendors": ["themehunk", "themehunk$PRODUCT$lead_form_builder_&_contact_form", "wordpress", "wordpress$PRODUCT$wordpress"]}