Cool Formkit Lite
Cool Formkit Lite (extensions-for-elementor-form) is a WordPress plugin with 2 published CVE records in this archive. The latest tracked vulnerability was published Oct 30, 2026; the highest published CVSS base score is 6.5.
extensions-for-elementor-formThis measures remediation-data coverage in this archive. It is not a claim that the plugin is vulnerability-free or insecure.
CVE-2026-118500: Cool FormKit Lite – Advanced Form Builder for Elementor: Stored cross-site scripting
The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The esc_html() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores an encoded double-quote to a raw double-quote inside text nodes when jQuery .html() extracts the template, allowing the attacker-controlled custom_id to break out of an HTML attribute context within the plugin's own frontend script. The vector marks UI:N, but the narrative’s victim viewing or interaction requirement still applies. The structured affected range is <= 2.7.9.
| Safe version |
|
||
|---|---|---|---|
| Oct 30, 2026 |
CVE-2026-118500
Cool FormKit Lite – Advanced Form Builder for Elementor: Stored cross-site scripting
The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The esc_html() call applied at server emission is bypassed because the HTML fragment-serialization algorithm restores an encoded double-quote to a raw double-quote inside text nodes when jQuery .html() extracts the template, allowing the attacker-controlled custom_id to break out of an HTML attribute context within the plugin's own frontend script. The vector marks UI:N, but the narrative’s victim viewing or interaction requirement still applies. The structured affected range is <= 2.7.9.
|
See mitigation notes |
CVE6.4
|
| Sep 30, 2026 |
CVE-2026-97301
Cool Formkit Lite: Cross-site scripting
Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. The reported impact is browser script execution in the affected site's origin. The injected field, rendering context and exact victim interaction are unspecified. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 2.7.9.
|
2.7.9 |
CVE6.5
|