{"id":"CVE-2026-121777","kind":"vulnerability","aliases":["CVE-2026-121777"],"related":[],"title":"Cool Formkit Lite WordPress plugin: stored script injection via form content","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool Formkit Lite extensions-for-elementor-form allows Code Injection.This issue affects Cool Formkit Lite: from n/a through 2.7.10.","summary":"Cool Formkit Lite, a WordPress form plugin for Elementor, fails to neutralize script-related HTML tags, enabling code injection into pages. An attacker can run scripts in visitors' browsers, which may lead to session theft or actions taken as the visitor.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cool-formkit-lite","elementor","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of Cool Formkit Lite in the WordPress admin plugin list, or look for the `extensions-for-elementor-form` plugin directory.\n- Compare the installed version with the affected range through `2.7.10`.","fix":"- Cool Formkit Lite: no fixed version is stated in the sources; unknown.","status":"open","published_at":"2026-11-07T13:16:35+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","triaged_at":"2026-11-07T13:49:31+00:00","updated_at":"2026-11-07T13:49:31+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T13:49:31Z","model":"claude-haiku-5-5","output":{"fix":"- Cool Formkit Lite: no fixed version is stated in the sources; unknown.","reach":"internet","title":"Cool Formkit Lite WordPress plugin: stored script injection via form content","impact":"medium","summary":"Cool Formkit Lite, a WordPress form plugin for Elementor, fails to neutralize script-related HTML tags, enabling code injection into pages. An attacker can run scripts in visitors' browsers, which may lead to session theft or actions taken as the visitor.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","elementor","cool-formkit-lite"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers on the affected site","analyst_note":"Confirm the fixed version and whether the injection needs authentication, using the NVD entry and the vendor's plugin changelog.","how_to_check":"- Check the installed version of Cool Formkit Lite in the WordPress admin plugin list, or look for the `extensions-for-elementor-form` plugin directory.\n- Compare the installed version with the affected range through `2.7.10`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running Cool Formkit Lite (`extensions-for-elementor-form`) up to and including `2.7.10` are exposed when the form output is rendered to visitors. Sites that do not use this plugin can skip it. The sources do not say whether authentication is required to inject content.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000718,"input_tokens":4243,"output_tokens":587,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121777':14A,17A '-2026':13A,16A '2.7.10':104C 'action':62B 'affect':97C 'allow':93C 'attack':48B 'basic':79C 'browser':54B 'code':43B,94C 'content':11A 'cool':1A,19B,25B,83C,85C,98C 'cool-formkit-lit':18B 'cve':12A,15A 'elementor':22B,33B,91C 'enabl':42B 'extens':89C 'extensions-for-elementor-form':88C 'fail':34B 'form':10A,30B,92C 'formkit':2A,20B,26B,86C,99C 'html':40B,73C 'improp':67C 'inject':8A,44B 'injection.this':95C 'issu':96C 'lead':57B 'lite':3A,21B,27B,87C,100C 'may':56B 'n/a':102C 'neutral':36B,68C 'packag':23B 'page':46B,78C 'plugin':5A,31B,84C 'relat':39B,72C 'run':50B 'script':7A,38B,51B,71C 'script-rel':37B,70C 'session':59B 'store':6A 'tag':41B,74C 'taken':63B 'theft':60B 'via':9A 'visitor':53B,66B 'vulner':81C 'web':77C 'wordpress':4A,24B,29B 'xss':80C","nicknames":[],"mitigations":[],"who_affected":"Sites running Cool Formkit Lite (`extensions-for-elementor-form`) up to and including `2.7.10` are exposed when the form output is rendered to visitors. Sites that do not use this plugin can skip it. The sources do not say whether authentication is required to inject content.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["coolformkitlite","elementor","medium","package","wordpress"],"campaign_type":null,"search_a":"'-121777':14A,17A '-2026':13A,16A 'content':11A 'cool':1A 'cve':12A,15A 'form':10A 'formkit':2A 'inject':8A 'lite':3A 'plugin':5A 'script':7A 'store':6A 'via':9A 'wordpress':4A","search_b":"'action':62B 'attack':48B 'browser':54B 'code':43B 'cool':19B,25B 'cool-formkit-lit':18B 'elementor':22B,33B 'enabl':42B 'fail':34B 'form':30B 'formkit':20B,26B 'html':40B 'inject':44B 'lead':57B 'lite':21B,27B 'may':56B 'neutral':36B 'packag':23B 'page':46B 'plugin':31B 'relat':39B 'run':50B 'script':38B,51B 'script-rel':37B 'session':59B 'tag':41B 'taken':63B 'theft':60B 'visitor':53B,66B 'wordpress':24B,29B","search_c":"'2.7.10':104C 'affect':97C 'allow':93C 'basic':79C 'code':94C 'cool':83C,85C,98C 'elementor':91C 'extens':89C 'extensions-for-elementor-form':88C 'form':92C 'formkit':86C,99C 'html':73C 'improp':67C 'injection.this':95C 'issu':96C 'lite':87C,100C 'n/a':102C 'neutral':68C 'page':78C 'plugin':84C 'relat':72C 'script':71C 'script-rel':70C 'tag':74C 'vulner':81C 'web':77C 'xss':80C","first_public_at":"2026-11-07T13:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121777","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121777","severity":null,"published_at":"2026-11-07T13:16:35+00:00","modified_at":"2026-11-07T13:16:35+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","fetched_at":"2026-11-07T13:47:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}