---
id: CVE-2026-86799
title: >-
  The Forms WordPress plugin before 3.0.2 does not sanitise submitted form
  values on storage, nor escape them before outputting them on the form
  submissions screen in the administration dashboard, allowing unauthenticated
  users to inject a…
summary: >-
  The Forms WordPress plugin before 3.0.2 does not sanitise submitted form
  values on storage, nor escape them before outputting them on the form
  submissions screen in the administration dashboard, allowing unauthenticated
  users to inject a…
severity: none
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:17:03.860'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-86799'
references:
  - url: 'https://wpscan.com/vulnerability/75bdda94-06b3-4747-bcd2-903167ac1c00/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-14T07:21:04.843Z'
---

## Overview

The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in the administration dashboard, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of any administrator viewing the submissions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.