Security readout for executives and security teams
Plain-English summary
CVE-2026-1244 affects the WordPress Forms Bridge plugin up to version 4.2.5. A logged-in user with Contributor-level access or higher can store malicious script through a shortcode attribute. That script can run when someone views the affected page, potentially impacting site administrators or visitors.
Executive priority
Prioritize this for WordPress sites with multiple content contributors or external authors. The issue is not currently reported as exploited, but stored XSS can affect administrators and site trust. Remediate through plugin update guidance and role review during normal vulnerability SLAs for moderate WordPress application risk.
Technical view
The issue is stored cross-site scripting, CWE-79, in the financoop_campaign shortcode id attribute. Sources cite insufficient input sanitization and output escaping in forms_bridge_financoop_shortcode_error. CVSS is 6.4, requiring low privileges and network access, with changed scope and limited confidentiality and integrity impact.
Likely exposure
Exposure is limited to WordPress sites running Forms Bridge – Infinite integrations versions up to and including 4.2.5, especially where untrusted users have Contributor or higher roles. Sites not using this plugin, or without such accounts, have reduced exposure based on the provided sources.
Exploitation context
No source in the bundle reports active exploitation, and CISA KEV is false. Exploitation requires an authenticated WordPress account with Contributor-level access or above. The impact is stored script execution when a user accesses an injected page.
Researcher notes
The provided references identify the vulnerable shortcode path and a WordPress.org changeset, but the bundle does not clearly state a fixed version. Avoid assuming exploit availability. Focus validation on installed plugin version, Contributor-plus user exposure, shortcode usage, and whether vendor guidance maps the changeset to a released fix.
Mitigation direction
- Inventory WordPress sites for the Forms Bridge plugin and installed version.
- Treat Forms Bridge versions 4.2.5 and earlier as vulnerable.
- Check Wordfence, WordPress.org, and vendor guidance for the fixed release.
- Update the plugin when a fixed version is available and approved.
- Restrict Contributor and higher roles to trusted users only.
- Review existing content using the financoop_campaign shortcode.
Validation and detection
- Confirm whether Forms Bridge – Infinite integrations is installed.
- Record the installed plugin version from WordPress administration or asset inventory.
- Identify users with Contributor, Author, Editor, or Administrator roles.
- Search site content for financoop_campaign shortcode usage.
- Review shortcode id attributes for unexpected script-like content.
- Verify remediation against vendor or Wordfence fixed-version guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-1244 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N3.12.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.4MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3e047822-5766-4e7f-be89-f4a15f0e6d51?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/forms-bridge/trunk/addons/financoop/shortcodes.php#L389CVE reference
- https://plugins.trac.wordpress.org/browser/forms-bridge/tags/4.2.3/addons/financoop/shortcodes.php#L389CVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3446693%40forms-bridge&new=3446693%40forms-bridge&sfp_email=&sfph_mail=#file1CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.