CVE-2026-95816

The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter in all versions up to, and including, 2.6.104 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce check protecting the rednao_smart_forms_save_form_values AJAX handler is only enforced when the smart_forms_block_anonymous_submissions option is enabled, meaning default installations require no authentication or nonce verification whatsoever to submit and store malicious payloads.

• CWE-79

• https://plugins.trac.wordpress.org/browser/smart-forms/trunk/js/dist/Entries_bundle.js#L388
• https://plugins.trac.wordpress.org/browser/smart-forms/trunk/js/dist/Entries_bundle.js#L588
• https://plugins.trac.wordpress.org/browser/smart-forms/trunk/js/dist/Entries_bundle.js#L802
• https://plugins.trac.wordpress.org/browser/smart-forms/trunk/smart-forms-ajax.php#L227
• https://plugins.trac.wordpress.org/browser/smart-forms/trunk/smartforms.php#L63
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ace194b6-c794-417c-9870-db8ebaa4cf7a?source=cve

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9581A vulnerability was identified in JeecgBoot up to 3.9.1. The…6.3
• CVE-2026-95811Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, f…6.5
• CVE-2026-95812ClipBucket v5 before 5.5.3-#182 contains a reflected cross-s…6.1
• CVE-2026-95813e621ng versions before 26.09.16 pass untrusted request param…6.1
• CVE-2026-95814Vaultwarden through 1.37.3 omits organization membership sta…8.1
• CVE-2026-95815OpenClaw iOS before 2026.8.11 logs complete agent deep-link …6.3
• CVE-2026-95817The DoFollow Case by Case plugin for WordPress is vulnerable…7.2
• CVE-2026-95818A stack-based buffer overflow in the dynamic loader (ld.so) …3.6
• CVE-2026-95819A vulnerability has been found in anirbandutta9 College-Note…7.3
• CVE-2026-9582A security flaw has been discovered in SourceCodester CET Au…4.3
• CVE-2026-95820A vulnerability was found in anirbandutta9 College-Notes-Gal…6.3
• CVE-2026-95828A vulnerability was determined in Mstfakts College-Managemen…4.3