CVE-2026-54851

WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

State: published CNA: Patchstack CVSS 3.1 7.1 High NVD: deferred

Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3.

Affected products

Vendor	Product	Versions
Awesomemotive	Contact Form by WPForms	≤2.0.3

References

External links from the record. They lead to third-party sites.

https://patchstack.com/database/wordpress/plugin/wpforms-lite/vulnerability/wordpress-contact-form-by-wpforms-plugin-2-0… vdb-entry

Dates

Reserved: 2026-06-16
Published: 2026-11-04
Updated: 2026-11-04

CVSS

7.1 High

Version: 3.1
Source: CNA (Patchstack)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

EPSS

0.146% probability of exploitation activity in the next 30 days

Percentile: 3.855%
Score date: 2026-11-04
Model: v2026.06.15

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

NVD

Status: Deferred
Published: 2026-11-04
Modified: 2026-11-04

7.1 High CVSS 3.1 · Patchstack, secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

This CVE at nvd.nist.gov