The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3 due to insufficient input sanitization an

Successful exploitation of CVE-2023-7063 allows an attacker to inject malicious JavaScript code into a WordPress site through a seemingly legitimate form submission. When a user views a page containing the injected script, it executes in their browser context, potentially stealing cookies, redirecting them to phishing sites, or defacing the website. The impact is amplified if the injected script targets administrators or users with elevated privileges, enabling further compromise of the WordPress installation and potentially the entire network. This vulnerability resembles other XSS attacks where user input is not properly sanitized before being displayed, leading to code execution.

1. Reserviert2023-12-21
2. Veröffentlicht2024-01-20
3. Geändert2025-05-30
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2023-7063 is to immediately upgrade WPForms Pro to version 1.8.5.4 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter potentially malicious form submission parameters. Specifically, look for unusual characters or patterns commonly associated with XSS payloads (e.g., <script>, <iframe>, javascript:). Additionally, review and sanitize all user-supplied input within your WordPress theme and plugins to prevent similar vulnerabilities. After upgrading, verify the fix by submitting a form with a simple XSS payload (e.g., <script>alert('XSS')</script>) and confirming that the script does not execute.