Multiple XSS vulnerabilities patched in WordPress plugins October 2026
Sucuri publishes October 2026 roundup of medium and high-risk flaws in Elementor, LiteSpeed Cache, and WooCommerce.
70
CVE-2026-101921
Reflected XSS in WPForms before 2.0.2.1
- CVSS 3.1
- 4.7 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
The WPForms plugin for WordPress allows unauthenticated reflected cross-site scripting when an administrator embeds a {query_var} smart tag in an iframe srcdoc attribute. An attacker tricks a user into clicking a malicious link on a page where Show Description is enabled. This executes injected scripts and affects any such WordPress site.
What to do: Apply Wordfence's update for CVE-2026-101921.
| Product | Affected |
|---|---|
| Wordfence WPForms | 2.0.2.1 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag (e.g. "x")' parameter in all versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and has enabled Show Description on a public-facing page.
- Ecosystems
- WordPress
- Weakness
- CWE-79
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N