CVE-2026-18409

WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit relies on the plugin's own wp_kses_allowed_html filter widening the 'post' allowlist to permit iframe elements with a data-src attribute, which is not on WordPress's URI-attribute sanitization list, allowing a javascript: URI stored in data-src to survive kses processing and subsequently be promoted to a live src attribute by the bundled admin script view-entry.min.js.

We have discovered 416,273 live websites that are affected by CVE-2026-18409.

Run a Free Instant Scan



Affected Software

Product  WPForms
Category Form Builders
Vulnerable Domains416,273 live websites (100% of WPForms install base)
Vulnerable Versions
  • from 0 through 2.0.0.2
Vulnerable Versions Count230 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')



Details

  • Published - Aug 21, 2026
  • Updated - Aug 21, 2026

Credits

  • daroo (finder)

Website Distribution by Country

Number of websites using CVE-2026-18409
United States135,973 websites


Germany42,208 websites
France25,132 websites
GB24,134 websites
Netherlands15,137 websites
Italy14,032 websites
Spain10,950 websites
Canada9,787 websites
Poland8,815 websites
India8,439 websites

Website Distribution by TLD

Number of websites using CVE-2026-18409
.com182,652 websites
.de25,346 websites
.org22,016 websites
.co.uk14,669 websites
.nl13,833 websites
.fr12,015 websites
.it10,053 websites
.net9,521 websites
.com.au7,263 websites
.pl6,710 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-18409

Top websites that are affected by CVE-2026-18409. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
************.com United States*,***
**********.com United States*,***
********.com United States*,***
****************.com United States*,***
************.com United States*,***
******.com United States*,***
******************.de Germany*,***
******.com United States*,***
*************.com United States*,***
*******.com United States*,***
See full domain list

FAQ

CVE-2026-18409 is Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in WPForms
A total of 416,273 websites have been identified as vulnerable to CVE-2026-18409, based on global website indexing conducted by WebTechSurvey.
The WPForms is affected by the CVE-2026-18409 vulnerability.
WPForms versions up to and including 2.0.0.2 are vulnerable to CVE-2026-18409.