EIP-2026-114275

PRE-CVE

Wordpress Plugin WPForms 1.6.3.1 - Persistent Cross Site Scripting (Authenticated)

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-114275. PoCs published by ZwX.

AI-analyzed exploit summary This exploit demonstrates a persistent XSS vulnerability in WPForms plugin version 1.6.3.1 and earlier. It shows how an authenticated attacker can inject malicious JavaScript into form descriptions, which executes when the form is previewed or viewed.

Description

Wordpress Plugin WPForms 1.6.3.1 - Persistent Cross Site Scripting (Authenticated)

Exploits (1)

exploitdb WORKING POC
by ZwX · textwebappsphp
https://www.exploit-db.com/exploits/49069

This exploit demonstrates a persistent XSS vulnerability in WPForms plugin version 1.6.3.1 and earlier. It shows how an authenticated attacker can inject malicious JavaScript into form descriptions, which executes when the form is previewed or viewed.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: WPForms WordPress Plugin <= 1.6.3.1
Auth required
Prerequisites: Authenticated access to WordPress admin panel · WPForms plugin installed and activated
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026