---
id: CVE-2026-86799
title: >-
  The Forms WordPress plugin before 3.0.2 does not sanitise submitted form
  values on storage, nor escape them before outputting them on the form
  submissions screen in the administration dashboard, allowing unauthenticated
  users to inject a…
summary: >-
  The Forms WordPress plugin before 3.0.2 does not sanitise submitted form
  values on storage, nor escape them before outputting them on the form
  submissions screen in the administration dashboard, allowing unauthenticated
  users to inject a…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:14:02.800'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86799'
references:
  - url: 'https://wpscan.com/vulnerability/75bdda94-06b3-4747-bcd2-903167ac1c00/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-10-14T07:21:04.843Z'
product: Forms
affected:
  - Forms < 3.0.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-14T13:27:48.188055Z'
epss: 0.00375
epssPercentile: 0.31298
---

## Overview

The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.