CVE WATCH / VULNERABILITY DETAIL
CVE-2026-122231
HIGHCVSS 7.2NVD feed
Published 7 November 2026 · tracked since 8 November 2026
Description
The WS Form LITE – Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field_<id>[0][0]' parameter in all versions up to, and including, 1.12.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthentica
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-113364
- CVE-2026-113363
- CVE-2026-113362
- CVE-2026-124502 MEDIUM 4.3
- CVE-2026-124500 MEDIUM 6.3
- CVE-2026-124499 MEDIUM 4.7
- CVE-2026-18893 HIGH 7.1
- CVE-2026-18546 MEDIUM 5.4
- CVE-2026-120113 MEDIUM 6.4
- CVE-2026-116500 MEDIUM 6.2