Get real-time updates on Telegram
CVE-2026-4703: WS Form LITE – Drag & Drop Contact Form Builder 0 through 1.10.80
CVE-2026-4703. CVSS 3.1 base score 9.8 (CRITICAL, Vendor/CNA). EPSS 0.00904 (percentile 0.58667), scored 11-Oct-2026.
Affected technology
WS Form LITE – Drag & Drop Contact Form Builder · 0 through 1.10.80
westguard
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · No user interaction required
What an attacker can do
The source says if a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Vendor/CNA’s CVSS 3.1 assessment (base score 9.8/10) rates confidentiality, integrity and availability impact as high.
- CWE
- CWE-502
- CCR priority
- 39.4 /100 (P4)
- CVSS 3.1
- 9.8 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · Vendor/CNA
- EPSS
- 0.00904 · percentile 0.58667 · 2026-10-11
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-12 16:54:24.294989+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-4703.html