CVE-2026-97301

MediumCVSS 6.5

Published: 30/09/2026(UTC)Updated: 23/10/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The Cool Formkit Lite plugin in versions up to and including 2.7.8 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of a malicious script into the site.

Risk Assessment

A low-privileged user can execute malicious code in other users' browsers, potentially leading to session theft or content modification.

Recommendation

Update the Cool Formkit Lite plugin to a version later than 2.7.8 to eliminate the XSS vulnerability.

Other vulnerabilities in Cool Formkit Lite

CVE-2026-118500Medium
The Cool FormKit Lite plugin for Elementor in versions up to and including 2.7.9 is vulnerable to stored DOM-based cross-site scripting via the '_elementor_data.form_fields[].custom_id' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with contributor-level access or above can inject arbitrary scripts that execute when a user visits the injected page.

Original NVD description (English source)

Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS