{"id":"CVE-2026-118500","kind":"vulnerability","aliases":["CVE-2026-118500"],"related":[],"title":"WordPress FormKit Lite plugin: stored XSS via form field custom_id","description":"The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The esc_html() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores " to a raw double-quote inside text nodes when jQuery .html() extracts the template, allowing the attacker-controlled custom_id to break out of an HTML attribute context within the plugin's own frontend script.","summary":"The Cool FormKit Lite plugin for WordPress and Elementor, versions up to and including 2.7.9, fails to sanitize the custom_id field of form fields, so injected scripts can run in pages. An attacker with contributor-level access can plant a script that runs in the browser of anyone who opens the injected page.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","formkit-lite","package","wordpress"],"not_affected_if":["admin-only-editing","plugin-not-installed"],"how_to_check":"- Check the installed version of the FormKit Lite plugin in the WordPress admin plugin list, looking for `2.7.9` or earlier\n- Look for the plugin slug in the site's `wp-content/plugins` directory","fix":null,"status":"open","published_at":"2026-10-30T06:16:47+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","triaged_at":"2026-10-30T06:29:52+00:00","updated_at":"2026-10-30T06:29:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-30T06:29:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress FormKit Lite plugin: stored XSS via form field custom_id","impact":"medium","summary":"The Cool FormKit Lite plugin for WordPress and Elementor, versions up to and including 2.7.9, fails to sanitize the custom_id field of form fields, so injected scripts can run in pages. An attacker with contributor-level access can plant a script that runs in the browser of anyone who opens the injected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","formkit-lite"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"script runs in visitors' browsers, stealing sessions or actions","analyst_note":"Confirm the fixed version of FormKit Lite beyond 2.7.9 from the plugin changelog or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-118500.","how_to_check":"- Check the installed version of the FormKit Lite plugin in the WordPress admin plugin list, looking for `2.7.9` or earlier\n- Look for the plugin slug in the site's `wp-content/plugins` directory","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","admin-only-editing"],"who_is_affected":"Sites running the Cool FormKit Lite plugin version 2.7.9 or earlier with Elementor, where contributor-level or higher users can edit pages. Sites without the plugin, or where only trusted administrators edit content, face less exposure. The sources do not say which fixed version exists.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000738,"input_tokens":4321,"output_tokens":612,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118500':14A,17A '-2026':13A,16A '2.7.9':38B,116C 'access':62B,136C,152C 'advanc':83C 'algorithm':172C 'allow':189C 'anyon':73B 'appli':160C 'arbitrari':141C 'attack':57B,131C,192C 'attacker-control':191C 'attribut':202C 'authent':130C 'base':97C 'break':197C 'browser':71B 'builder':85C 'bypass':165C 'call':159C 'context':203C 'contributor':60B,134C 'contributor-level':59B,133C 'control':193C 'cool':25B,80C 'cross':99C 'cross-sit':98C 'custom':10A,43B,106C,194C 'cve':12A,15A 'dom':96C 'dom-bas':95C 'doubl':178C 'double-quot':177C 'due':117C 'elementor':18B,32B,87C 'elementor_data.form':104C 'emiss':163C 'esc':157C 'escap':124C 'execut':148C 'extract':186C 'fail':39B 'field':9A,45B,48B,105C 'form':8A,47B,84C 'formkit':2A,20B,26B,81C 'formkit-lit':19B 'fragment':170C 'fragment-seri':169C 'frontend':209C 'html':158C,168C,185C,201C 'id':11A,44B,107C,195C 'includ':37B,115C 'inject':50B,77B,140C,154C 'input':120C 'insid':180C 'insuffici':119C 'jqueri':184C 'level':61B,135C 'lite':3A,21B,27B,82C 'make':126C 'node':182C 'open':75B 'output':123C 'packag':22B 'page':55B,78B,145C,155C 'paramet':108C 'plant':64B 'plugin':4A,28B,88C,206C 'possibl':128C 'quot':179C 'raw':176C 'restor':173C 'run':53B,68B 'sanit':41B,121C 'script':51B,66B,101C,143C,210C 'serial':171C 'server':162C 'site':100C 'store':5A,94C 'templat':188C 'text':181C 'user':151C 'version':33B,111C 'via':7A,102C 'vulner':92C 'web':142C 'whenev':149C 'within':204C 'wordpress':1A,23B,30B,90C 'xss':6A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Cool FormKit Lite plugin version 2.7.9 or earlier with Elementor, where contributor-level or higher users can edit pages. Sites without the plugin, or where only trusted administrators edit content, face less exposure. The sources do not say which fixed version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T06:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118500","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118500","severity":null,"published_at":"2026-10-30T06:16:47+00:00","modified_at":"2026-10-30T06:16:47+00:00","first_seen_at":"2026-10-30T06:28:39+00:00","fetched_at":"2026-10-30T06:28:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}