What is the CVSS score of EUVD-2026-35995?

EUVD-2026-35995 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

MW WP Form EUVD-2026-35995

| CVE-2026-8853 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-10 security@wordfence.com

GHSA-xqph-m7fw-c4rf

XSS WordPress

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 10, 2026 - 08:32 vuln.today

CVE Published

Jun 10, 2026 - 08:16 nvd

MEDIUM 4.4

DescriptionCVE.org

The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'memo' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the memo value is stored via update_post_meta() rather than wp_insert_post(), WordPress's built-in kses and unfiltered_html protections do not apply, allowing attackers to break out of the textarea element via injected closing tags regardless of role-based content filtering.

AnalysisAI

Stored Cross-Site Scripting in the MW WP Form WordPress plugin (all versions through 5.1.3) allows authenticated editor-level attackers to inject persistent malicious scripts via the 'memo' parameter that execute in the browsers of any user who views the affected contact data page. The vulnerability is made possible by a specific bypass of WordPress Core sanitization: because memo values are stored via update_post_meta() rather than wp_insert_post(), the native wp_kses_post() and unfiltered_html capability checks are never invoked, permitting editors - who are normally prevented from injecting raw HTML - to break out of the textarea element using injected closing tags. No public exploit has been identified at time of analysis, and the CVSS 4.4 Medium score reflects the high privilege and high complexity prerequisites.

Technical ContextAI

MW WP Form is a WordPress plugin providing contact form and form submission management. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a failure of input sanitization before storage and output escaping before rendering. The critical architectural detail is the storage pathway: WordPress Core hooks its kses sanitization filter (wp_kses_post) and the unfiltered_html capability gate into the wp_insert_post() flow - but not into the postmeta API (update_post_meta). By routing memo field data through update_post_meta(), the plugin stores raw, unsanitized attacker-controlled content in the database. The unsanitized value is then rendered in the contact data detail template at templates/contact-data/detail.php (line 77) without proper escaping, allowing injected closing tags to break out of the textarea HTML context. The vulnerable input handling is visible in the plugin repository at classes/controllers/class.contact-data.php (line 134) for both versions 5.1.0 and 5.1.3.

RemediationAI

Update the MW WP Form plugin to version 5.1.4 or later; the fix is evidenced by the trac changeset between tags 5.1.3 and 5.1.4 at https://plugins.trac.wordpress.org/changeset?old_path=mw-wp-form/tags/5.1.3&new_path=mw-wp-form/tags/5.1.4, though the exact patched version has not been independently verified beyond this changeset reference. If an immediate upgrade is not feasible, reduce the editor-level account population to the minimum necessary trusted users, since exploitation requires a valid editor (or higher) account - revoking unnecessary elevated accounts directly eliminates the attack surface. As an additional compensating control, a WAF rule targeting injected HTML closing tags in the 'memo' POST parameter can reduce exploitation risk, though this may produce false positives for legitimate rich-text form inputs. Wordfence users should ensure their firewall rules are current for this CVE identifier. Reference the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/2a6dfdec-c1c6-4300-ab0a-9fd1c550d09f for plugin-specific guidance.