What is CVE-2026-1454?

CVE-2026-1454 is a high-severity vulnerability in Themehunk Lead Form Builder & Contact, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2026-03-11.

How severe is CVE-2026-1454?

High severity. CVSS v3 base score is 7.2 out of 10.

XSS in Themehunk Lead Form Builder & Contact

CVE-2026-1454

The Responsive Contact Form Builder & Lead Generation Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0.1 via form field submissions. This is due to insufficient input sanitization in the lfb_lead_sanitize() function which omits certain field types from its sanitization whitelist, combined with an overly permissive wp_kses() filter at output time that allows onclick attributes on anchor tags. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the lead entries in the WordPress dashboard.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.002 (15.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.

Affected products

Themehunk Lead Form Builder & Contact — versions 0

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

Frequently asked questions

What is CVE-2026-1454?: CVE-2026-1454 is a high-severity vulnerability in Themehunk Lead Form Builder & Contact, classified under Cross-site Scripting. CVSS score: 7.2/10. Published 2026-03-11.
How severe is CVE-2026-1454?: High severity. CVSS v3 base score is 7.2 out of 10.