CVE-2026-1244

The Forms Bridge – Infinite integrations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute in the 'financoop_campaign' shortcode in all versions up to, and including, 4.2.5. This is due to insufficient input sanitization and output escaping on the user-supplied 'id' parameter in the forms_bridge_financoop_shortcode_error function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

• CWE-79

• https://plugins.trac.wordpress.org/browser/forms-bridge/tags/4.2.3/addons/financoop/shortcodes.php#L389
• https://plugins.trac.wordpress.org/browser/forms-bridge/trunk/addons/financoop/shortcodes.php#L389
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3446693%40forms-bridge&new=3446693%40forms-bridge&sfp_email=&sfph_mail=#file1
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3e047822-5766-4e7f-be89-f4a15f0e6d51?source=cve

Published

Jan 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12434The List category posts plugin for WordPress is vulnerable t…4.3
• CVE-2026-12435The Motors – Car Dealership & Classified Listings Plugin plu…4.3
• CVE-2026-12436GitLab has remediated an issue in GitLab CE/EE affecting all…8.4
• CVE-2026-12437Use after free in WebShare in Google Chrome on Windows prior…8.3
• CVE-2026-12438Inappropriate implementation in WebView in Google Chrome on …8.3
• CVE-2026-12439Use after free in Digital Credentials in Google Chrome prior…8.8
• CVE-2026-12440Use after free in DigitalCredentials in Google Chrome on Win…9.6
• CVE-2026-12441Use after free in File Input in Google Chrome on Linux prior…8.8
• CVE-2026-12442Use after free in Passwords in Google Chrome on Android prio…8.8
• CVE-2026-12443Use after free in Web Authentication in Google Chrome prior …8.8
• CVE-2026-12444Out of bounds read in Chromoting in Google Chrome on Windows…5.5
• CVE-2026-12445Use after free in Extensions in Google Chrome prior to 149.0…7.5