AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH2026

Δ / VULNERABILITY RECORD

CVE-2026-101921.

Source-reported disclosure and enrichment record.

SEVERITY / CVSSMEDIUM / 4.7CVSS 3.1 · security@wordfence.com

EXPLOITATION STATUSNot listed in the cached KEV catalogThis does not establish absence of exploitation.

RECORD STATUSReceivedModified Oct 10, 2026

Disclosure summary

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag (e.g. "x")' parameter in all versions up to, and including, 2.0.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that a site administrator has previously saved a form whose description embeds a {query_var} Smart Tag inside an iframe srcdoc attribute and has enabled Show Description on a public-facing page.

Source-reported weakness categories

CWE-79

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

CVEProject/cvelistV5 releases · RSS-2b11a7e1dade072c26c14342ed52b8ffeb8

Open original source · Updated Oct 10, 2026

CVE 2026-10-10_2300Z

CVE mention in publisher metadata; check the original affected versions.

CVEProject/cvelistV5 releases · RSS-f946067cb6a34653c12f3a7d3e105773b0f

Open original source · Updated Oct 10, 2026

CVE 2026-10-10_2200Z

CVE mention in publisher metadata; check the original affected versions.

CVEProject/cvelistV5 releases · RSS-7c1aa4e02ee105026a9d5ef835739da2231

Open original source · Updated Oct 10, 2026

CVE 2026-10-10_2100Z

CVE mention in publisher metadata; check the original affected versions.

CVEProject/cvelistV5 releases · RSS-5daad76275e9590636f1bfed69854f874d0

Open original source · Updated Oct 10, 2026

CVE 2026-10-10_2000Z

CVE mention in publisher metadata; check the original affected versions.

CVEProject/cvelistV5 releases · RSS-f5a41e504aba4034d4f99f9de25577fb6a1

Open original source · Updated Oct 10, 2026

CVE 2026-10-10_1900Z

CVE mention in publisher metadata; check the original affected versions.

CVEProject/cvelistV5 releases · RSS-f5dee9e139662097b84b17b3e74d5544c25

Open original source · Updated Oct 10, 2026

CVE 2026-10-10_1800Z

CVE mention in publisher metadata; check the original affected versions.

CVEProject/cvelistV5 releases · RSS-6729502a4ea3125ddd379f75d3eb8cb63a6

Open original source · Updated Oct 10, 2026

CVE 2026-10-10_1700Z

CVE mention in publisher metadata; check the original affected versions.

CVEProject/cvelistV5 releases · RSS-a10ecc85ff20aad80a7e8436dd92befdcfc

Open original source · Updated Oct 10, 2026

CVE 2026-10-10_1600Z

CVE mention in publisher metadata; check the original affected versions.

CVEProject/cvelistV5 releases · RSS-5f26de48c2d7605f54c0980f1221b67644b

Open original source · Updated Oct 10, 2026

CVE 2026-10-10_1500Z

CVE mention in publisher metadata; check the original affected versions.

CVEProject/cvelistV5 releases · RSS-95eb7d8256449b8a75dc66291b65bfe37a2

Open original source · Updated Oct 10, 2026

CVE 2026-10-10_1400Z

CVE mention in publisher metadata; check the original affected versions.

NIST National Vulnerability Database · NVD-CVE-2026-101921

Open original source · Updated Oct 10, 2026

Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.

Original records & references

PUBLISHED 2026-10-10T04:17:03-04:00
MODIFIED 2026-10-10T04:17:03-04:00
INGESTED 2026-10-10T20:55:12-04:00