Security Alert Summary
The Integration with Hubspot Forms plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the hubspotform shortcode. Insufficient input sanitization and output escaping on user-supplied shortcode attributes allow authenticated users with Contributor-level access and above to inject scripts that execute when a page is viewed.
CVE Details
- CVE ID: CVE-2026-1908
- Affected component: Integration with Hubspot Forms plugin for WordPress
- Affected versions: All versions up to, and including, 1.2.2
- Published: March 21, 2026 at 04:16:56 AM
- Last modified: March 21, 2026 at 04:16:56 AM
- CVSS v3.1: Base Score 6.4, MEDIUM — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / Privileges: Requires an authenticated user with low privileges (Contributor-level access or higher)
- User interaction: None
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a stored Cross-Site Scripting issue in the plugin’s handling of the hubspotform shortcode. The plugin does not sufficiently sanitize or escape user-supplied attributes for that shortcode, allowing an authenticated user with Contributor-level access or greater to include arbitrary script content in a shortcode attribute. When a page containing the injected shortcode is viewed, the injected script is served to other users and executes in their browsers.
The project references point to the plugin implementation in includes/EmbedHubspotForms.php (see referenced line locations). The underlying cause is missing input validation and missing output escaping for shortcode attributes, which enables stored script insertion into page markup.
Impact is limited to what stored XSS can achieve in the context of the site and user roles affected: execution of attacker-supplied JavaScript in the browser of users who view the infected page. This can be used to manipulate page content, steal session-limited data available in the browser context, or perform actions the viewer can perform within their session, consistent with the CVSS confidentiality and integrity impacts.
How This Could Impact Your Website
Imagine a site where the site owner maintains pages and several internal staff members contribute content. An external contractor or a staff member with Contributor-level access could create or edit content that includes the vulnerable hubspotform shortcode and add a malicious attribute value. Any editor, admin, or visitor who opens the page could execute the injected script in their browser.
Practical consequences include exposure of data available to the viewer’s browser session, such as profile or session-limited information, and an increased risk of targeted phishing or social engineering against users whose email addresses or other details are discoverable via the site. If an attacker can reach users with elevated privileges via crafted content, they could attempt further actions that align with the low integrity impact noted in the CVSS score.
professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributors and other low-privilege accounts that can create or edit content.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and content changes for unusual behavior, including unexpected shortcode usage or edits.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/integration-with-hubspot-forms/tags/1.2.2/includes/EmbedHubspotForms.php#L183
- https://plugins.trac.wordpress.org/browser/integration-with-hubspot-forms/trunk/includes/EmbedHubspotForms.php#L183
- https://www.wordfence.com/threat-intel/vulnerabilities/id/aac2b2a3-5d4f-449f-876c-d1bec295e088?source=cve
