CVE-2026-95816Published
Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-95816 · Microsoft / collected KEV context
cve-program · CVE-2026-95816
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ace194b6-c794-417c-9870-db8ebaa4cf7a?source=cve
- https://plugins.trac.wordpress.org/browser/smart-forms/trunk/js/dist/Entries_bundle.js#L802
- https://plugins.trac.wordpress.org/browser/smart-forms/trunk/js/dist/Entries_bundle.js#L388
- https://plugins.trac.wordpress.org/browser/smart-forms/trunk/js/dist/Entries_bundle.js#L588
- https://plugins.trac.wordpress.org/browser/smart-forms/trunk/smart-forms-ajax.php#L227
- https://plugins.trac.wordpress.org/browser/smart-forms/trunk/smartforms.php#L63
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.