MW WP Form < 5.1.6 – Editor+ Stored XSS via Inquiry Data List | CVE 2026-78364

Description

The plugin does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

Proof of Concept

The PoC will be displayed on September 11, 2026, to give users the time to update.

Affects Plugins

mw-wp-form

Fixed in 5.1.6

References

CVE

CVE-2026-78364

Classification

Type

XSS

OWASP top 10

A7: Cross-Site Scripting (XSS)

CWE

CWE-79

CVSS

3.5 (low)

Miscellaneous

Original Researcher

Sai Praneeth Koti

Submitter

Sai Praneeth Koti

Verified

Yes

WPVDB ID

285b87e1-110f-4192-a098-e64e2eb447a8

Timeline

Publicly Published

2026-08-28 (about 2 days ago)

Added

2026-08-28 (about 1 day ago)

Last Updated

2026-08-28 (about 1 day ago)

Other

Published

Title

Published

2025-09-22

Title

Geolocation IP Detection < 5.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published

2025-07-18

Title

OpenStreetMap for Gutenberg and WPBakery Page Builder <= 1.2.0 - Contributor+ Stored XSS

Published

2025-01-16

Title

RS Survey <= 1.0 - Reflected Cross-Site Scripting

Published

2022-12-05

Title

Loginizer < 1.7.6 - Reflected XSS

Published

2022-07-14

Title

WP Comments Fields < 4.1 - Admin+ Stored Cross-Site Scripting