WS-FORM · CVE-2026-122231 · Package
FIX → 1.12.19
The WS Form LITE contact form builder plugin for WordPress up to and including 1.12.18 fails to sanitize the field_<id> parameter, so content submitted through it is stored and later rendered unescaped. An unauthenticated attacker can inject JavaScript that runs in the browser of any user who opens an affected page, including site administrators.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
WordPress sites running the WS Form LITE plugin at 1.12.18 or earlier. An unauthenticated visitor can submit a nested-array value in a field_<id> parameter that the plugin's client-side esc_html() helper does not escape, so the script runs when someone, such as an admin, views the injected page. Sites without WS Form LITE, or on 1.12.19 or later, can skip it. WS Form PRO is not named in the sources.
Not affected if plugin-not-installed, plugin-updated-past-1.12.18
Who cares wordpress, wp-plugin, ws-form-lite, xss
Upgrade to 1.12.19
Update WS Form LITE to 1.12.19 (per Wordfence/Patchstack; vendor changelog not confirmed).
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field_<id>[0][0]' parameter in all versions up to, and including, 1.12.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the client-side esc_html() helper returns any non-string value unchanged, allowing a nested-array payload coerced via Array.prototype.toString to reach jQuery .append() unescaped.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.