CVE-2026-75091: Quill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Sites using the Quill Forms WordPress plugin in version 5.7.1 or earlier are affected. Exploitation does not require authentication or user interaction from the attacker.
What must occur for the injected script to run?
An attacker can inject arbitrary web scripts into pages. The scripts execute when a user accesses an injected page, which can expose or alter content in that user’s browser session.
Is a non-patching workaround documented?
The affected versions are described as having insufficient input sanitization and output escaping. The provided data does not identify a configuration change or mitigation for sites that cannot update immediately.