What is the CVSS score of CVE-2026-5169?

CVE-2026-5169 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-5169

EUVD-2026-20119 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-j4gw-px6w-59j5

WordPress PHP XSS

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 07:00 euvd

EUVD-2026-20119

Analysis Generated

Apr 08, 2026 - 07:00 vuln.today

CVE Published

Apr 08, 2026 - 06:43 nvd

MEDIUM 4.4

DescriptionCVE.org

The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Form Header' field in versions up to and including 1.0. This is due to insufficient input sanitization when saving via update_option() and lack of output escaping when displaying the stored value. The vulnerability exists in two locations: (1) the plugin settings page at inq_form.php line 180 where the value is echoed into an HTML attribute without esc_attr(), and (2) the front-end shortcode output at inquery_form_to_posts_or_pages.php line 139 where the value is output in HTML content without esc_html(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that will execute whenever a user accesses the plugin settings page or views a page containing the [inquiry_form] shortcode.

AnalysisAI

Stored cross-site scripting in the Inquiry Form to Posts or Pages WordPress plugin up to version 1.0 allows authenticated administrators to inject arbitrary JavaScript via the 'Form Header' field, executing when users access the plugin settings page or view pages containing the [inquiry_form] shortcode. The vulnerability stems from insufficient input sanitization during option storage and missing output escaping in two rendering locations. CVSS 4.4 reflects the high privilege requirement (administrator-only access) and limited impact, though the stored nature and cross-site scope elevate concern for sites with multiple administrators or role delegation.

Technical ContextAI

The vulnerability is a classic Stored XSS (CWE-79) resulting from improper handling of untrusted data in a WordPress plugin context. The plugin uses WordPress's update_option() function to store user input from the 'Form Header' configuration field without sanitization (wp_kses_post() or similar), and then outputs the stored value in two contexts without escaping: (1) in HTML attributes via echo without esc_attr() at inq_form.php line 180, and (2) in HTML content via echo without esc_html() at inquery_form_to_posts_or_pages.php line 139. The plugin identifier cpe:2.3:a:udamadu:inquiry_form_to_posts_or_pages:*:*:*:*:*:*:*:* confirms this is a third-party WordPress plugin published to the official WordPress plugin repository. The vulnerability persists in the trunk (development) version, indicating no patch has been applied upstream.

RemediationAI

Vendor-released patch not independently confirmed at time of analysis; the trunk branch remains unfixed. Immediate remediation requires disabling and removing the plugin until a patched version is available. Site administrators should monitor the WordPress plugin repository and Wordfence intelligence for a patched release (expected version 1.1 or later). As a temporary mitigation for sites that cannot immediately remove the plugin, restrict administrator access to only trusted users and avoid granting plugin-management capabilities to non-core staff; however, this does not eliminate the vulnerability and is not a substitute for patching. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/743788ed-bd40-4eb4-a27e-d4eb89df3a41?source=cve provides additional remediation guidance and will be updated once a patched version is released.