CVE-2026-95816 Details

A stored cross-site scripting vulnerability has been identified in the Smart Forms WordPress plugin, affecting all versions through 2.6.104. The issue arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the compromised pages. The vulnerability exploits the 'formString' parameter, and the associated nonce check for the rednao_smart_forms_save_form_values AJAX handler is only applied when the smart_forms_block_anonymous_submissions option is active. Consequently, default installations lack authentication or nonce verification, enabling the submission and storage of malicious payloads without restriction.