CVE-2026-118500
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Cool FormKit Lite plugin for Elementor in versions up to and including 2.7.9 is vulnerable to stored DOM-based cross-site scripting via the '_elementor_data.form_fields[].custom_id' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary scripts that execute when a user visits the injected page.
Risk Assessment
Injected scripts can execute in users' browsers, enabling session theft or other actions in the victim's context.
Recommendation
Update the Cool FormKit Lite plugin to a version later than 2.7.9. Until then, restrict contributor roles and monitor form content.
Other vulnerabilities in Cool FormKit Lite
Original NVD description (English source)
The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The esc_html() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores " to a raw double-quote inside text nodes when jQuery .html() extracts the template, allowing the attacker-controlled custom_id to break out of an HTML attribute context within the plugin's own frontend script.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS