{"id":"CVE-2026-122231","kind":"vulnerability","aliases":["CVE-2026-122231"],"related":[],"title":"WS Form LITE WordPress plugin: unauthenticated stored cross-site scripting via form fields","description":"The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field_<id>[0][0]' parameter in all versions up to, and including, 1.12.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the client-side esc_html() helper returns any non-string value unchanged, allowing a nested-array payload coerced via Array.prototype.toString to reach jQuery .append() unescaped.","summary":"The WS Form LITE contact form builder plugin for WordPress up to and including 1.12.18 fails to sanitize the field_<id> parameter, so content submitted through it is stored and later rendered unescaped. An unauthenticated attacker can inject JavaScript that runs in the browser of any user who opens an affected page, including site administrators.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ws-form","fixed":["1.12.19"],"affected":"<= 1.12.18","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","wordpress","wp-plugin","ws-form-lite","xss"],"not_affected_if":["plugin-not-installed","plugin-updated-past-1.12.18"],"how_to_check":"- WordPress admin > Plugins > Installed Plugins: WS Form LITE version. Or run: wp plugin get ws-form --field=version\n- Vulnerable if version is 1.12.18 or earlier (plugin folder wp-content/plugins/ws-form/). 1.12.19 or later is patched.\n- Also check if you run WS Form PRO: the sources name only LITE; PRO is not confirmed affected.","fix":"Update WS Form LITE to 1.12.19 (per Wordfence/Patchstack; vendor changelog not confirmed).","status":"open","published_at":"2026-11-07T12:17:45+00:00","first_seen_at":"2026-11-07T12:47:09+00:00","triaged_at":"2026-11-07T12:48:49+00:00","updated_at":"2026-11-07T12:51:26+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-07T12:48:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WS Form LITE WordPress plugin: unauthenticated stored cross-site scripting via form fields","impact":"medium","summary":"The WS Form LITE contact form builder plugin for WordPress up to and including 1.12.18 fails to sanitize the field_<id> parameter, so content submitted through it is stored and later rendered unescaped. An unauthenticated attacker can inject JavaScript that runs in the browser of any user who opens an affected page, including site administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","ws-form-lite"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker script runs in visitors' and admins' browsers, enabling session theft.","analyst_note":"Confirm the fixed version after 1.12.18 from the plugin's changelog or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-122231.","how_to_check":"- Check the installed version of the WS Form LITE plugin in the WordPress admin under Plugins, or in `wp-content/plugins/ws-form/`.\n- Flag any installation at `1.12.18` or earlier.\n- unknown for a fixed version: the sources do not give one.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated-past-1.12.18"],"who_is_affected":"Sites running the WS Form LITE plugin at version 1.12.18 or earlier that publish pages containing WS Form forms. The flaw is reached by unauthenticated submissions, so any public form on such a site is exposed. Sites without this plugin are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4354,"output_tokens":646,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed version after 1.12.18 from the plugin's changelog or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-122231.","search":"'-122231':17A,20A '-2026':16A,19A '0':111C,112C '1.12.18':48B,121C 'access':150C 'administr':87B 'affect':83B 'allow':172C 'append':184C 'arbitrari':139C 'array':176C 'array.prototype.tostring':180C 'attack':68B,136C 'browser':76B 'builder':40B,96C 'client':160C 'client-sid':159C 'coerc':178C 'contact':38B,94C 'content':56B 'cross':9A,105C 'cross-sit':8A,104C 'cve':15A,18A 'drag':92C 'drop':93C 'due':122C 'esc':162C 'escap':129C 'execut':146C 'fail':49B 'field':14A,53B,110C 'form':2A,13A,23A,31B,36B,39B,90C,95C 'helper':164C 'html':163C 'includ':47B,85B,120C 'inject':70B,138C,152C 'input':125C 'insuffici':124C 'javascript':71B 'jqueri':183C 'later':63B 'lite':3A,32B,37B,91C 'make':131C 'nest':175C 'nested-array':174C 'non':168C 'non-str':167C 'open':81B 'output':128C 'packag':24B 'page':84B,143C,153C 'paramet':54B,113C 'payload':177C 'plugin':5A,28B,41B,97C 'possibl':133C,156C 'reach':182C 'render':64B 'return':165C 'run':73B 'sanit':51B,126C 'script':11A,107C,141C 'side':161C 'site':10A,86B,106C 'store':7A,61B,103C 'string':169C 'submit':57B 'unauthent':6A,67B,135C 'unchang':171C 'unescap':65B,185C 'user':79B,149C 'valu':170C 'version':116C 'via':12A,108C,179C 'vulner':101C 'web':140C 'whenev':147C 'wordpress':4A,25B,43B,99C 'wp':27B 'wp-plugin':26B 'ws':1A,22A,30B,35B,89C 'ws-form':21A 'ws-form-lit':29B 'xss':33B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the WS Form LITE plugin at 1.12.18 or earlier. An unauthenticated visitor can submit a nested-array value in a field_<id> parameter that the plugin's client-side esc_html() helper does not escape, so the script runs when someone, such as an admin, views the injected page. Sites without WS Form LITE, or on 1.12.19 or later, can skip it. WS Form PRO is not named in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["wsform"],"ptokens":["form","ws"],"labels":["high","package","wordpress","wpplugin","wsformlite","xss"],"campaign_type":null,"search_a":"'-122231':17A,20A '-2026':16A,19A 'cross':9A 'cross-sit':8A 'cve':15A,18A 'field':14A 'form':2A,13A,23A 'lite':3A 'plugin':5A 'script':11A 'site':10A 'store':7A 'unauthent':6A 'via':12A 'wordpress':4A 'ws':1A,22A 'ws-form':21A","search_b":"'1.12.18':48B 'administr':87B 'affect':83B 'attack':68B 'browser':76B 'builder':40B 'contact':38B 'content':56B 'fail':49B 'field':53B 'form':31B,36B,39B 'includ':47B,85B 'inject':70B 'javascript':71B 'later':63B 'lite':32B,37B 'open':81B 'packag':24B 'page':84B 'paramet':54B 'plugin':28B,41B 'render':64B 'run':73B 'sanit':51B 'site':86B 'store':61B 'submit':57B 'unauthent':67B 'unescap':65B 'user':79B 'wordpress':25B,43B 'wp':27B 'wp-plugin':26B 'ws':30B,35B 'ws-form-lit':29B 'xss':33B","search_c":"'0':111C,112C '1.12.18':121C 'access':150C 'allow':172C 'append':184C 'arbitrari':139C 'array':176C 'array.prototype.tostring':180C 'attack':136C 'builder':96C 'client':160C 'client-sid':159C 'coerc':178C 'contact':94C 'cross':105C 'cross-sit':104C 'drag':92C 'drop':93C 'due':122C 'esc':162C 'escap':129C 'execut':146C 'field':110C 'form':90C,95C 'helper':164C 'html':163C 'includ':120C 'inject':138C,152C 'input':125C 'insuffici':124C 'jqueri':183C 'lite':91C 'make':131C 'nest':175C 'nested-array':174C 'non':168C 'non-str':167C 'output':128C 'page':143C,153C 'paramet':113C 'payload':177C 'plugin':97C 'possibl':133C,156C 'reach':182C 'return':165C 'sanit':126C 'script':107C,141C 'side':161C 'site':106C 'store':103C 'string':169C 'unauthent':135C 'unchang':171C 'unescap':185C 'user':149C 'valu':170C 'version':116C 'via':108C,179C 'vulner':101C 'web':140C 'whenev':147C 'wordpress':99C 'ws':89C","first_public_at":"2026-11-07T12:17:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122231","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122231","severity":null,"published_at":"2026-11-07T12:17:45+00:00","modified_at":"2026-11-07T12:17:45+00:00","first_seen_at":"2026-11-07T12:47:09+00:00","fetched_at":"2026-11-07T12:47:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-122231:2112","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ws-form/ws-form-lite-11218-unauthenticated-stored-cross-site-scripting-via-text-field-array-value","severity":null,"published_at":"2026-11-07T12:51:26+00:00","modified_at":"2026-11-07T12:51:26+00:00","first_seen_at":"2026-11-07T12:51:26+00:00","fetched_at":"2026-11-07T12:51:26+00:00","note":"Wordfence (researcher UKO, CNA) and Patchstack both list fix 1.12.19; vendor changelog (wordpress.org page) did not show the entry, so fix not marked verified. No exploitation or PoC found; Patchstack expects mass-exploitation potential.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ws-form/ws-form-lite-11218-unauthenticated-stored-cross-site-scripting-via-text-field-array-value","https://patchstack.com/database/wordpress/plugin/ws-form/vulnerability/wordpress-ws-form-lite-drag-drop-contact-form-builder-plugin-1-12-18-unauthenticated-stored-cross-site-scripting-vulnerability"]}],"documents":[{"id":95560,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ws-form/ws-form-lite-11218-unauthenticated-stored-cross-site-scripting-via-text-field-array-value","title":"Wordfence: WS Form LITE <= 1.12.18 Unauthenticated Stored XSS","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":95561,"url":"https://patchstack.com/database/wordpress/plugin/ws-form/vulnerability/wordpress-ws-form-lite-drag-drop-contact-form-builder-plugin-1-12-18-unauthenticated-stored-cross-site-scripting-vulnerability","title":"Patchstack: WS Form LITE <= 1.12.18 XSS, patched 1.12.19","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}