CVE-2026-2707

🗓️ 11 Mar 2026 05:27:17Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 58 Views🌐 WEB

Stored XSS in weForms via REST API entries 1.6.27; Subscriber+ can inject scripts into hidden fields.

Reporter	Title	Published	Views	Family All 11
CNNVD	WeForms WordPress plugin has a cross-site scripting vulnerability	11 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-2707 weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API	11 Mar 202605:27	–	cvelist
EUVD	EUVD-2026-11099	11 Mar 202606:31	–	euvd
EUVD	EUVD-2026-11100	11 Mar 202605:27	–	euvd
NVD	CVE-2026-2707	11 Mar 202606:17	–	nvd
Patchstack	WordPress weForms plugin <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API vulnerability	11 Mar 202610:42	–	patchstack
Positive Technologies	PT-2026-24579	11 Mar 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-2707: Improper Neutralization of Input During Web Page Generation	11 Mar 202600:00	–	rapid7
RedhatCVE	CVE-2026-2707	26 Mar 202615:08	–	redhatcve
Vulnrichment	CVE-2026-2707 weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API	11 Mar 202605:27	–	vulnrichment

Vulners

Node

weformspro weformsRange≤1.6.27wordpress

[
  {
    "vendor": "boldgrid",
    "product": "weForms – Easy Drag & Drop Contact Form Builder For WordPress",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.6.27",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/BoldGrid/weforms/pull/263
plugins	www.plugins.trac.wordpress.org/browser/weforms/trunk/includes/fields/class-abstract-fields.php
plugins	www.plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/includes/fields/class-abstract-fields.php
plugins	www.plugins.trac.wordpress.org/changeset
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e97854ca-b24f-4893-862d-f8e975752175
plugins	www.plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/assets/js-templates/spa-components.php
plugins	www.plugins.trac.wordpress.org/browser/weforms/trunk/assets/js-templates/spa-components.php

Parameter	Position	Path	Description	CWE
hidden field values	request body	/wp-json/weforms/v1/forms/{id}/entries/	Stored Cross-Site Scripting (XSS) via the REST API entry submission endpoint. The `prepare_entry()` method fails to properly sanitize input received via the WP_REST_Request object, allowing attackers to inject scripts into hidden field values.	CWE-79

17 Jun 2026 10:31Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.16.4

EPSS0.00389

SSVC

CWE-79