CVE-2026-39435: WordPress CformsII plugin <= 15.1.3 - Cross Site Scripting (XSS) vulnerability

Synopsis

A reflected or stored cross-site scripting (XSS) vulnerability exists in the WordPress CformsII plugin at version 15.1.3 and earlier. The flaw is reachable over the network without any authentication, but requires a victim to interact with a crafted link or page. Successful exploitation lets an attacker inject and execute arbitrary JavaScript in a victim's browser, enabling session hijacking, content manipulation, and minor service disruption. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via standard HTTP or HTTPS traffic.

• AuthenticationNot required

  No account or credential is needed; the attacker can trigger the vulnerable code path as an anonymous user.

• Victim interactionRequired

  A victim must follow a crafted link or visit an attacker-controlled page that triggers the malicious script, making this a social-engineering vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or environmental preconditions.

Blast Radius

• Reads session cookies or authentication tokens from the victim's browser session, enabling account takeover.
• Injects arbitrary content into the page the victim is viewing, allowing defacement or phishing within the trusted WordPress origin.
• Performs actions inside the WordPress application on behalf of the victim, including modifying settings or submitting forms.
• Causes minor disruption to the victim's browser session by redirecting or breaking page functionality.