CVE-2026-28568: WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability

Q: Which installations are exposed, and does exploitation require an account?

Sites using the WordPress Quill Forms plugin at version 5.7.1 or earlier are affected. The issue is described as unauthenticated, so an attacker does not need a WordPress account to attempt exploitation.

Q: Is a default Quill Forms configuration known to be affected?

The supplied data does not state whether the vulnerable behavior is enabled in the default configuration or identify a specific form, endpoint, or setting that triggers it.

Q: What mitigation is available if updating is not immediately possible?

The supplied data identifies affected versions through 5.7.1 but does not provide a fixed version, workaround, or mitigation for environments that cannot patch immediately.

Published Aug 18, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

Affected Software

1 affected component

WordPress Quill Forms<=5.7.1

Event History

Aug 18, 2026

CVE Published

via MITRE·01:59 PM

Data Sourced

via MITRE·01:59 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·02:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which installations are exposed, and does exploitation require an account?

Sites using the WordPress Quill Forms plugin at version 5.7.1 or earlier are affected. The issue is described as unauthenticated, so an attacker does not need a WordPress account to attempt exploitation.

Is a default Quill Forms configuration known to be affected?

The supplied data does not state whether the vulnerable behavior is enabled in the default configuration or identify a specific form, endpoint, or setting that triggers it.

What mitigation is available if updating is not immediately possible?