← CVE Intelligence

CVE-2026-78364

MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List PUBLISHED

Description (CNA)

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

Affected (CNA)

Vendor / productVersions
Unknown / MW WP Formaffected 0 before 5.1.6

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.