CVE-2026-2707

🗓️ 11 Mar 2026 05:27:17Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 14 Views🌐 WEB

Stored XSS in weForms via REST API entries 1.6.27; Subscriber+ can inject scripts into hidden fields.

Reporter	Title	Published	Views	Family All 11
CNNVD	WordPress plugin weForms 跨站脚本漏洞	11 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-2707 weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API	11 Mar 202605:27	–	cvelist
EUVD	EUVD-2026-11099	11 Mar 202606:31	–	euvd
EUVD	EUVD-2026-11100	11 Mar 202605:27	–	euvd
NVD	CVE-2026-2707	11 Mar 202606:17	–	nvd
OSV	CVE-2026-2707	11 Mar 202606:17	–	osv
Patchstack	WordPress weForms plugin <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API vulnerability	11 Mar 202610:42	–	patchstack
Positive Technologies	PT-2026-24579	11 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-2707	26 Mar 202615:08	–	redhatcve
Vulnrichment	CVE-2026-2707 weForms <= 1.6.27 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Hidden Field Value via REST API	11 Mar 202605:27	–	vulnrichment

Vulners

Node

boldgrid weforms_easy_drag_&_drop_contact_form_builder_for_wordpressRange≤1.6.27wordpress

[
  {
    "vendor": "boldgrid",
    "product": "weForms – Easy Drag & Drop Contact Form Builder For WordPress",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.6.27",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/weforms/trunk/assets/js-templates/spa-components.php
github	www.github.com/BoldGrid/weforms/pull/263
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/e97854ca-b24f-4893-862d-f8e975752175
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/weforms/trunk/includes/fields/class-abstract-fields.php
plugins	www.plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/includes/fields/class-abstract-fields.php
plugins	www.plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/assets/js-templates/spa-components.php

Parameter	Position	Path	Description	CWE
entry_values	request body	wp-json/weforms/v1/forms/{id}/entries/	Stored XSS via REST API form entry submission in weForms plugin allows injection of scripts in form entry values processed by the REST API.	CWE-79
hidden_field_values	request body	wp-json/weforms/v1/forms/{id}/entries/	Stored XSS via REST API form entry submission in weForms plugin allows injection of scripts in form entry values processed by the REST API.	CWE-79
form_data	request body	wp-json/weforms/v1/forms/{id}/entries/	Stored XSS via REST API form entry submission in weForms plugin allows injection of scripts in form entry values processed by the REST API.	CWE-79

17 Jun 2026 10:31Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.4

EPSS0.00214

SSVC

CWE-79