CVE-2026-2707

🗓️ 11 Mar 2026 05:27:17Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 9 Views🌐 WEB

Stored XSS in weForms via REST API entries 1.6.27; Subscriber+ can inject scripts into hidden fields.

Reporter	Title	Published	Views	Family All 10
CNNVD	WordPress plugin weForms 跨站脚本漏洞	11 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-2707 weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API	11 Mar 202605:27	–	cvelist
EUVD	EUVD-2026-11099	11 Mar 202606:31	–	euvd
EUVD	EUVD-2026-11100	11 Mar 202605:27	–	euvd
NVD	CVE-2026-2707	11 Mar 202606:17	–	nvd
Patchstack	WordPress weForms plugin <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API vulnerability	11 Mar 202610:42	–	patchstack
Positive Technologies	PT-2026-24579	11 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-2707	26 Mar 202615:08	–	redhatcve
Vulnrichment	CVE-2026-2707 weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API	11 Mar 202605:27	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (March 9, 2026 to March 15, 2026)	19 Mar 202616:12	–	wordfence

Vulners

Node

boldgrid weforms_easy_drag_&_drop_contact_form_builder_for_wordpressRange≤1.6.27wordpress

[
  {
    "vendor": "boldgrid",
    "product": "weForms – Easy Drag & Drop Contact Form Builder For WordPress",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.6.27",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/weforms/trunk/assets/js-templates/spa-components.php
github	www.github.com/BoldGrid/weforms/pull/263
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e97854ca-b24f-4893-862d-f8e975752175
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/weforms/trunk/includes/fields/class-abstract-fields.php
plugins	www.plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/includes/fields/class-abstract-fields.php
plugins	www.plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/assets/js-templates/spa-components.php

Parameter	Position	Path	Description	CWE
field_values	request body	wp-json/weforms/v1/forms/{id}/entries/	Stored XSS via REST API entry submission in weForms plugin; authenticated users with Subscriber+ can inject scripts into hidden form fields submitted through the REST endpoint, which render on admin form entries page.	CWE-79
hidden_field_values	request body	wp-json/weforms/v1/forms/{id}/entries/	Stored XSS via REST API entry submission in weForms plugin; authenticated users with Subscriber+ can inject scripts into hidden form fields submitted through the REST endpoint, which render on admin form entries page.	CWE-79
entry_data	request body	wp-json/weforms/v1/forms/{id}/entries/	Stored XSS via REST API entry submission in weForms plugin; authenticated users with Subscriber+ can inject scripts into hidden form fields submitted through the REST endpoint, which render on admin form entries page.	CWE-79

22 Apr 2026 21:27Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.4

EPSS0.00054

SSVC

CWE-79