SZB-4c7245eed6
EUVD-2026-113714: Stored DOM-based XSS reported in Cool FormKit Lite plugin
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- coolplugins
- Product
- Cool FormKit Lite
- First seen
Summary
EUVD record EUVD-2026-113714 rates a stored DOM-based cross-site scripting flaw in the Cool FormKit Lite WordPress plugin at 6.4/10 (CVSS v3.1). The item says the flaw is reachable via the '_elementor_data.form_fields[].custom_id' parameter.
If you use coolplugins
Check whether Cool FormKit Lite is installed on your WordPress sites
Update the plugin to the latest patched version
Review form submissions for injected scripts
What the sources say 1
· Mastodon: “The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the '_elementor_data.form_fields[].custom_id' parameter” Source