CVE-2026-32574

HighCVSS 7.1

Published: 06/10/2026(UTC)Updated: 13/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.

Risk Assessment

The risk includes potential execution of malicious scripts in the user's browser, leading to data theft, session hijacking, or content manipulation.

Recommendation

Upgrade the Smart Forms plugin to a version above 2.6.104 and implement input and output filtering.

Other vulnerabilities in Smart Forms

CVE-2026-95816High
The Smart Forms plugin for WordPress up to version 2.6.104 is vulnerable to Stored Cross-Site Scripting via the 'formString' parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS