Cross-site scripting in Form Plugin - #VU165528
Published: November 11, 2026
Vulnerability identifier: #VU165528
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary JavaScript in a victim's browser in the context of the affected website.
The vulnerability exists due to improper neutralization of HTML in the Form Plugin resetForm() function when processing the for attribute of a label element. A remote attacker can supply a malicious attribute value such as <img src=x onerror=alert()> that is passed to jQuery's $() function without checking for HTML, causing arbitrary JavaScript to execute when the victim interacts with a page that invokes resetForm() on the affected label.
Affected software
Form Plugin
Remediation
Install security update from vendor's website.
Form Plugin - update to 4.4.0