CVE-2026-2707

{"id": "CVE-2026-2707", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2707", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T14:08:42.756058Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "boldgrid", "product": "weForms \u2013 Easy Drag & Drop Contact Form Builder For WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6.27"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-11T06:17:14.587", "references": [{"url": "https://github.com/BoldGrid/weforms/pull/263", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/assets/js-templates/spa-components.php#L80", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/weforms/tags/1.6.27/includes/fields/class-abstract-fields.php#L542", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/weforms/trunk/assets/js-templates/spa-components.php#L80", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/weforms/trunk/includes/fields/class-abstract-fields.php#L542", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3475812%40weforms%2Ftrunk&old=3457241%40weforms%2Ftrunk&sfp_email=&sfph_mail=", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e97854ca-b24f-4893-862d-f8e975752175?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API entry submission endpoint in all versions up to, and including, 1.6.27. This is due to inconsistent input sanitization between the frontend AJAX handler and the REST API endpoint. When entries are submitted via the REST API (`/wp-json/weforms/v1/forms/{id}/entries/`), the `prepare_entry()` method in `class-abstract-fields.php` receives the WP_REST_Request object as `$args`, bypassing the `weforms_clean()` fallback that sanitizes `$_POST` data for frontend submissions. The base field handler only applies `trim()` to the value. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into form entry hidden field values via the REST API that execute when an administrator views the form entries page, where data is rendered using a Vue.js `v-html` directive without escaping."}, {"lang": "es", "value": "El plugin weForms para WordPress es vulnerable a Cross-Site Scripting Almacenado a trav\u00e9s del endpoint de env\u00edo de entradas de la API REST en todas las versiones hasta la 1.6.27, inclusive. Esto se debe a una sanitizaci\u00f3n de entrada inconsistente entre el gestor AJAX de frontend y el endpoint de la API REST. Cuando las entradas se env\u00edan a trav\u00e9s de la API REST (`/wp-json/weforms/v1/forms/{id}/entries/`), el m\u00e9todo `prepare_entry()` en `class-abstract-fields.php` recibe el objeto WP_REST_Request como `$args`, omitiendo el fallback `weforms_clean()` que sanitiza los datos de `$_POST` para env\u00edos de frontend. El gestor de campo base solo aplica `trim()` al valor. Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, inyecten scripts web arbitrarios en los valores de campos ocultos de las entradas de formulario a trav\u00e9s de la API REST que se ejecutan cuando un administrador ve la p\u00e1gina de entradas del formulario, donde los datos se renderizan usando una directiva `v-html` de Vue.js sin escape."}], "lastModified": "2026-06-17T10:31:34.830", "sourceIdentifier": "security@wordfence.com"}