CVE-2026-2707

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2707", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-18T19:24:22.125Z", "datePublished": "2026-03-11T05:27:17.695Z", "dateUpdated": "2026-04-08T17:30:47.196Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:47.196Z"}, "affected": [{"vendor": "boldgrid", "product": "weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6.27", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API entry submission endpoint in all versions up to, and including, 1.6.27. This is due to inconsistent input sanitization between the frontend AJAX handler and the REST API endpoint. When entries are submitted via the REST API (`/wp-json/weforms/v1/forms/{id}/entries/`), the `prepare_entry()` method in `class-abstract-fields.php` receives the WP_REST_Request object as `$args`, bypassing the `weforms_clean()` fallback that sanitizes `$_POST` data for frontend submissions. The base field handler only applies `trim()` to the value. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into form entry hidden field values via the REST API that execute when an administrator views the form entries page, where data is rendered using a Vue.js `v-html` directive without escaping."}], "title": "weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e97854ca-b24f-4893-862d-f8e975752175?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/includes/fields/class-abstract-fields.php#L542"}, {"url": "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/assets/js-templates/spa-components.php#L80"}, {"url": "https://plugins.trac.wordpress.org/browser/weforms/trunk/includes/fields/class-abstract-fields.php#L542"}, {"url": "https://plugins.trac.wordpress.org/browser/weforms/trunk/assets/js-templates/spa-components.php#L80"}, {"url": "https://github.com/BoldGrid/weforms/pull/263"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3475812%40weforms%2Ftrunk&old=3457241%40weforms%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Sharief"}], "timeline": [{"time": "2026-02-18T19:39:46.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-10T17:12:51.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T14:08:42.756058Z", "id": "CVE-2026-2707", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:10:34.186Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2707", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T14:08:42.756058Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T14:10:27.238Z"}}], "cna": {"title": "weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Sharief"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "boldgrid", "product": "weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.27"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-18T19:39:46.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-10T17:12:51.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e97854ca-b24f-4893-862d-f8e975752175?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/includes/fields/class-abstract-fields.php#L542"}, {"url": "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/assets/js-templates/spa-components.php#L80"}, {"url": "https://plugins.trac.wordpress.org/browser/weforms/trunk/includes/fields/class-abstract-fields.php#L542"}, {"url": "https://plugins.trac.wordpress.org/browser/weforms/trunk/assets/js-templates/spa-components.php#L80"}, {"url": "https://github.com/BoldGrid/weforms/pull/263"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3475812%40weforms%2Ftrunk&old=3457241%40weforms%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API entry submission endpoint in all versions up to, and including, 1.6.27. This is due to inconsistent input sanitization between the frontend AJAX handler and the REST API endpoint. When entries are submitted via the REST API (`/wp-json/weforms/v1/forms/{id}/entries/`), the `prepare_entry()` method in `class-abstract-fields.php` receives the WP_REST_Request object as `$args`, bypassing the `weforms_clean()` fallback that sanitizes `$_POST` data for frontend submissions. The base field handler only applies `trim()` to the value. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into form entry hidden field values via the REST API that execute when an administrator views the form entries page, where data is rendered using a Vue.js `v-html` directive without escaping."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:30:47.196Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2707", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:30:47.196Z", "dateReserved": "2026-02-18T19:24:22.125Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-11T05:27:17.695Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress", "vendor": "boldgrid", "versions": [{"lessThanOrEqual": "1.6.27", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API entry submission endpoint in all versions up to, and including, 1.6.27. This is due to inconsistent input sanitization between the frontend AJAX handler and the REST API endpoint. When entries are submitted via the REST API (`/wp-json/weforms/v1/forms/{id}/entries/`), the `prepare_entry()` method in `class-abstract-fields.php` receives the WP_REST_Request object as `$args`, bypassing the `weforms_clean()` fallback that sanitizes `$_POST` data for frontend submissions. The base field handler only applies `trim()` to the value. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into form entry hidden field values via the REST API that execute when an administrator views the form entries page, where data is rendered using a Vue.js `v-html` directive without escaping."}, {"lang": "es", "value": "El plugin weForms para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del endpoint de env\u00edo de entradas de la API REST en todas las versiones hasta la 1.6.27, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada inconsistente entre el gestor AJAX de frontend y el endpoint de la API REST. Cuando las entradas se env\u00edan a trav\u00e9s de la API REST (`/wp-json/weforms/v1/forms/{id}/entries/`), el m\u00e9todo `prepare_entry()` en `class-abstract-fields.php` recibe el objeto WP_REST_Request como `$args`, omitiendo el fallback `weforms_clean()` que sanitiza los datos de `$_POST` para env\u00edos de frontend. El gestor de campo base solo aplica `trim()` al valor. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, inyecten scripts web arbitrarios en los valores de campos ocultos de las entradas de formulario a trav\u00e9s de la API REST que se ejecutan cuando un administrador ve la p\u00e1gina de entradas del formulario, donde los datos se renderizan usando una directiva `v-html` de Vue.js sin escape."}], "id": "CVE-2026-2707", "lastModified": "2026-06-17T10:31:34.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2707", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T14:08:42.756058Z", "version": "2.0.3"}}]}, "published": "2026-03-11T06:17:14.587", "references": [{"source": "security@wordfence.com", "url": "https://github.com/BoldGrid/weforms/pull/263"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/assets/js-templates/spa-components.php#L80"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/includes/fields/class-abstract-fields.php#L542"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/weforms/trunk/assets/js-templates/spa-components.php#L80"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/weforms/trunk/includes/fields/class-abstract-fields.php#L542"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3475812%40weforms%2Ftrunk&old=3457241%40weforms%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e97854ca-b24f-4893-862d-f8e975752175?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.6.27]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress", "source": "cna", "vendor": "boldgrid"}, "product": "weforms_\u2013_easy_drag_&_drop_contact_form_builder_for_wordpress", "vendor": "boldgrid"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-17T17:34:22.257679+00:00", "value": {"mitigation_remediation": ["Upgrade Boldgrid:weForms to a version newer than 1.6.27 (e.g., any release after 1.6.27)."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The flaw affects the Boldgrid:weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress plugin in all released versions up to and including 1.6.27. Versions newer than 1.6.27 are not identified as vulnerable in the input data, so no specific version beyond that is known to be at risk.", "description_and_impact": "The weForms plugin for WordPress has a Stored Cross\u2011Site Scripting flaw that allows an authenticated user with Subscriber\u2011level access or higher to inject arbitrary JavaScript into hidden form field values via the REST API entry submission endpoint. The injected scripts are stored without proper sanitization because the REST API bypasses the normal input\u2011cleanup logic used for frontend AJAX submissions. When an administrator later opens the form entries page, the data is rendered by Vue.js using a v\u2011html directive that does not escape the content, causing the script to execute in the browser context.", "risk_and_exploitability": "The CVSS v3.1 base score of 6.4 indicates moderate severity, and an EPSS score of less than 1\u202f% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker be able to authenticate to the site with a Subscriber or higher role and submit a crafted payload to the REST API endpoint /wp\u2011json/weforms/v1/forms/{id}/entries/. When an administrator views the stored entries, the malicious JavaScript will run, potentially leading to theft of session cookies, defacement, or further lateral movement within the WordPress installation."}}}}, "created": "2026-03-11T11:37:52.292989+00:00", "updated": "2026-03-20T14:37:50.081456+00:00", "vendors": ["boldgrid", "boldgrid$PRODUCT$weforms_\u2013_easy_drag_&_drop_contact_form_builder_for_wordpress", "wordpress", "wordpress$PRODUCT$wordpress"]}