What the vulnerability does
01Description
The HTML Forms – Simple WordPress Forms Plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.0 due to insufficient sanitization of fabricated file upload field metadata before displaying it in the WordPress admin dashboard. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever an administrator accesses the form submissions page.
Explanation of Vulnerability in Simple Terms
02Summary
The HTML Forms plugin for WordPress contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into form submissions. An attacker can craft a malicious link or page that, when visited by a site administrator or user, executes arbitrary JavaScript in their browser. This can lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.
What an attacker can do
03Attacker Capabilities
Inject and execute malicious JavaScript in a user's browser when they interact with a crafted form or link.
Potential impact on your site
04Site Impact
Attackers can steal admin sessions, modify site content, create new admin accounts, or harvest user data through injected scripts.
Conditions required to exploit
05Prerequisites
The victim must visit a malicious page or click a crafted link while logged into the WordPress site.
Key dates
06Disclosure timeline
December 17, 2025
CVE published
April 8, 2026
Record updated
