CVE-2026-78364: MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List

Q: Which users can exploit this issue, and who is at risk from the payload?

A user with the Editor role or higher can exploit the issue. The stored script may execute when a higher-privileged user, such as an administrator, views the affected admin dashboard page.

Q: What versions should be remediated?

MW WP Form versions earlier than 5.1.6 are affected. Upgrade the plugin to version 5.1.6 or later.

Q: Where is the vulnerable data displayed?

The affected form settings are output on an admin dashboard page associated with the inquiry data list. The issue occurs because some settings are not sanitized and escaped before that output.

Published Aug 30, 2026

Updated

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

Affected Software

1 affected component

MW WP Form WordPress plugin<5.1.6

Event History

Aug 30, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Which users can exploit this issue, and who is at risk from the payload?

A user with the Editor role or higher can exploit the issue. The stored script may execute when a higher-privileged user, such as an administrator, views the affected admin dashboard page.

What versions should be remediated?

MW WP Form versions earlier than 5.1.6 are affected. Upgrade the plugin to version 5.1.6 or later.

Where is the vulnerable data displayed?

The affected form settings are output on an admin dashboard page associated with the inquiry data list. The issue occurs because some settings are not sanitized and escaped before that output.