CVE-2026-13378

HIGH

Form Vibes <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field

Title source: cna

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-13378. PoCs published by incogbyte.

AI-analyzed exploit summary This PoC exploits CVE-2026-13378, an unauthenticated stored XSS vulnerability in Form Vibes (WordPress plugin) <= 1.5.2. The exploit bypasses Contact Form 7's scalar-field validation by submitting a field as an array (e.g., `your-name[]`), which is then improperly sanitized and stored in the database by Form Vibes, leading to arbitrary JavaScript execution when viewed by an admin.

Description

The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Exploits (1)

github WORKING POC 4 stars

by incogbyte · pythonpoc

https://github.com/incogbyte/wp-cve-exploits/tree/main/CVE-2026-13378

View Code ZIP pw:eip

This PoC exploits CVE-2026-13378, an unauthenticated stored XSS vulnerability in Form Vibes (WordPress plugin) <= 1.5.2. The exploit bypasses Contact Form 7's scalar-field validation by submitting a field as an array (e.g., `your-name[]`), which is then improperly sanitized and stored in the database by Form Vibes, leading to arbitrary JavaScript execution when viewed by an admin.

Classification

Working Poc 100%

Attack Type

Xss

Complexity

Moderate

Reliability

Reliable

Target: Form Vibes - Database Manager for Forms <= 1.5.2 (WordPress plugin)

No auth needed

Prerequisites: Target must have Form Vibes <= 1.5.2 and Contact Form 7 installed · A Contact Form 7 form with a scalar field (e.g., `[text* your-name]`) must be publicly accessible · For full verification, wp-cli access to the target's database (though the exploit itself is unauthenticated)

MITRE ATT&CK

T1059.007 - JavaScript T1189 - Drive-by Compromise

mistral-large-3 · analyzed Jul 18, 2026 Full analysis →