Read the docs
TI-2026-86584 Aliases CVE-2026-121777GHSA-4vxc-v48g-jxpc

Cross-site scripting in WordPress Cool Formkit Lite plugin

Priority LOW 39CWE-80Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-80.

Summary

The Cool Formkit Lite plugin by Cool Plugins for WordPress is affected from n/a through 2.7.10. Improper neutralization of script-related HTML tags (CWE-80) lets web page content carry injected code. A remote attacker without privileges or user interaction can inject code into pages, which affects confidentiality.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Description from the CNA

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool Formkit Lite extensions-for-elementor-form allows Code Injection.This issue affects Cool Formkit Lite: from n/a through 2.7.10.

Why it matters now

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cool PluginsCool Formkit Liteup to 2.7.10—No fix listedCNA
  • Cool Formkit Lite VendorCool Plugins Affected up to 2.7.10 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Cool Formkit Lite.

Written with Claude Haiku 5.5 from the sources below · 2026-11-07

Timeline

  1. 2026-11-07 Threatist record created from CVE-2026-121777
  2. 2026-11-07 Alias added: GHSA-4vxc-v48g-jxpc

References

Other 1

  • TI-2024-35937 WordPress Cryptocurrency Widgets For Elementor plugin <= 1.6.4 - Local File Inclusion vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2024-00651 SQL injection in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List CVSS 3.1CRITICAL 9.8
  • TI-2023-18496 WordPress Cryptocurrency Widgets – Price Ticker & Coins List plugin <= 2.6.2 - Broken Access Control vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-04540 Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activation CVSS 3.1HIGH 8.8
  • TI-2023-28579 WordPress Events Shortcodes & Templates For The Events Calendar Plugin <= 2.3.1 is vulnerable to SQL Injection CVSS 3.1HIGH 8.8
  • TI-2021-03206 Process Steps Template Designer <= 1.2.1 - Cross-Site Request Forgery CVSS 3.1HIGH 8.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences