Reflected XSS in WPForms Contact Form Plugin

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Contact Form by WPForms (wpforms-lite) versions through 2.0.3 contain a Reflected Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. This CWE-79 vulnerability matters because it enables threat actors to steal user credentials, hijack sessions, and compromise website visitors without requiring the victim to install anything. WordPress site administrators and end-users who rely on WPForms for contact forms are directly affected, particularly those who haven't updated beyond version 2.0.3.

Casky's 323 matching skills detect the attack patterns behind this CVE by analyzing both Initial Access (TA0001) and Reconnaissance (TA0043) techniques. Using Claude AI with extended reasoning, practitioners will observe findings that reveal how attackers craft malicious URLs containing unfiltered input that reflects directly into page responses—the hallmark of reflected XSS. The platform identifies suspicious parameter manipulation, script tag injection attempts, and encoding evasion patterns typical of XSS exploitation chains. Practitioners would see detection signals showing how adversaries probe form inputs for sanitization gaps, craft payloads designed to execute in victim browsers, and potentially chain this vulnerability into credential theft or malware delivery campaigns.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-54851.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-54851

Casky has 323 skills that investigate the attack patterns behind CVE-2026-54851. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn