---
id: "CVE-2026-122231"
page: "https://infrastack.ai/live/CVE-2026-122231"
kind: "vulnerability"
aliases: ["CVE-2026-122231"]
title: "WS Form LITE WordPress plugin: unauthenticated stored cross-site scripting via form fields"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "ws-form", "fixed": ["1.12.19"], "affected": "<= 1.12.18", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "wordpress", "wp-plugin", "ws-form-lite", "xss"]
not_affected_if: ["plugin-not-installed", "plugin-updated-past-1.12.18"]
published_at: "2026-11-07T12:17:45+00:00"
first_seen_at: "2026-11-07T12:47:09+00:00"
updated_at: "2026-11-07T12:51:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122231", "first_seen_at": "2026-11-07T12:47:09+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ws-form/ws-form-lite-11218-unauthenticated-stored-cross-site-scripting-via-text-field-array-value", "first_seen_at": "2026-11-07T12:51:26+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ws-form/ws-form-lite-11218-unauthenticated-stored-cross-site-scripting-via-text-field-array-value", "https://patchstack.com/database/wordpress/plugin/ws-form/vulnerability/wordpress-ws-form-lite-drag-drop-contact-form-builder-plugin-1-12-18-unauthenticated-stored-cross-site-scripting-vulnerability"]}]
exploit_sources: []
---

# WS Form LITE WordPress plugin: unauthenticated stored cross-site scripting via form fields

Link for people: https://infrastack.ai/live/CVE-2026-122231 (this .md is for agents)

The WS Form LITE contact form builder plugin for WordPress up to and including 1.12.18 fails to sanitize the field_<id> parameter, so content submitted through it is stored and later rendered unescaped. An unauthenticated attacker can inject JavaScript that runs in the browser of any user who opens an affected page, including site administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:ws-form affected <= 1.12.18 fixed 1.12.19

## How to check

- WordPress admin > Plugins > Installed Plugins: WS Form LITE version. Or run: wp plugin get ws-form --field=version
- Vulnerable if version is 1.12.18 or earlier (plugin folder wp-content/plugins/ws-form/). 1.12.19 or later is patched.
- Also check if you run WS Form PRO: the sources name only LITE; PRO is not confirmed affected.

## Fix

Update WS Form LITE to 1.12.19 (per Wordfence/Patchstack; vendor changelog not confirmed).

## Timeline

- 2026-11-07T12:47:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122231
- 2026-11-07T12:51:26+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ws-form/ws-form-lite-11218-unauthenticated-stored-cross-site-scripting-via-text-field-array-value — Wordfence (researcher UKO, CNA) and Patchstack both list fix 1.12.19; vendor changelog (wordpress.org page) did not show the entry, so fix not marked verified. No exploitation or PoC found; Patchstack expects mass-exploitation potential.

## Documents

- [advisory] Wordfence: WS Form LITE <= 1.12.18 Unauthenticated Stored XSS https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ws-form/ws-form-lite-11218-unauthenticated-stored-cross-site-scripting-via-text-field-array-value
- [fix] Patchstack: WS Form LITE <= 1.12.18 XSS, patched 1.12.19 https://patchstack.com/database/wordpress/plugin/ws-form/vulnerability/wordpress-ws-form-lite-drag-drop-contact-form-builder-plugin-1-12-18-unauthenticated-stored-cross-site-scripting-vulnerability

## From the sources

The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field_<id>[0][0]' parameter in all versions up to, and including, 1.12.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the client-side esc_html() helper returns any non-string value unchanged, allowing a nested-array payload coerced via Array.prototype.toString to reach jQuery .append() unescaped.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_