{"id":"CVE-2026-118500","aliases":["EUVD-2026-113714","GHSA-755c-vvf8-fm4g"],"status":"published","title":"Cool FormKit Lite \u003c= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter","description":"The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The esc_html() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores \u0026quot; to a raw double-quote inside text nodes when jQuery .html() extracts the template, allowing the attacker-controlled custom_id to break out of an HTML attribute context within the plugin's own frontend script.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00216,"percentile":0.12112,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-10-30T05:35:51Z","modified":"2026-11-01T02:31:08Z","products":[{"vendor":"coolplugins","product":"cool formkit lite – advanced form builder for elementor"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/94c6ee49-604d-4183-bd47-7ab2732de6b4?source=cve","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/extensions-for-elementor-form/tags/2.7.9/assets/js/shared/logic-frontend.js#L719","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/extensions-for-elementor-form/tags/2.7.9/includes/fields/conditional-fields-trait.php#L753","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/extensions-for-elementor-form/tags/2.7.9/includes/fields/conditional-fields-trait.php#L704","tags":["web"]},{"url":"https://plugins.trac.wordpress.org/browser/extensions-for-elementor-form/tags/2.7.9/modules/forms/widgets/cool-form.php#L711","tags":["web"]},{"url":"https://github.com/CoolPluginsTeam/extensions-for-elementor-form/pull/90","tags":["fix"]},{"url":"https://plugins.trac.wordpress.org/changeset/3772891/extensions-for-elementor-form/trunk/assets/js/shared/logic-frontend.js","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118500","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-755c-vvf8-fm4g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118500.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-118500","title":"Cool FormKit Lite \u003c= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter","description":"The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The esc_html() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores \u0026quot; to a raw double-quote inside text nodes when jQuery .html() extracts the template, allowing the attacker-controlled custom_id to break out of an HTML attribute context within the plugin's own frontend script.","status":"published","published":"2026-10-30T05:35:51.355Z","modified":"2026-10-30T15:57:46.333Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:04.156238Z"}],"euvd":[{"id":"EUVD-2026-113714","description":"The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The esc_html() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores \u0026quot; to a raw double-quote inside text nodes when jQuery .html() extracts the template, allowing the attacker-controlled custom_id to break out of an HTML attribute context within the plugin's own frontend script.","status":"published","published":"2026-10-30T05:35:51Z","modified":"2026-10-30T15:57:46Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:59:05.913237Z"}],"ghsa":[{"id":"GHSA-755c-vvf8-fm4g","title":"The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to...","description":"The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The esc_html() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores \u0026quot; to a raw double-quote inside text nodes when jQuery .html() extracts the template, allowing the attacker-controlled custom_id to break out of an HTML attribute context within the plugin's own frontend script.","status":"published","published":"2026-10-30T06:32:02Z","modified":"2026-10-30T06:32:09Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:14:41.74258Z"}],"nvd":[{"id":"CVE-2026-118500","description":"The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The esc_html() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores \u0026quot; to a raw double-quote inside text nodes when jQuery .html() extracts the template, allowing the attacker-controlled custom_id to break out of an HTML attribute context within the plugin's own frontend script.","status":"published","published":"2026-10-30T06:16:47.61Z","modified":"2026-10-30T16:17:42.103Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:13:04.940026Z"}],"osv":[{"id":"CVE-2026-118500","title":"Cool FormKit Lite \u003c= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter","description":"The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The esc_html() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores \u0026quot; to a raw double-quote inside text nodes when jQuery .html() extracts the template, allowing the attacker-controlled custom_id to break out of an HTML attribute context within the plugin's own frontend script.","status":"published","published":"2026-10-30T05:35:51.355Z","modified":"2026-11-01T02:31:08.737657519Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:57.008854Z"}]}}