Quill Forms EUVD-2026-60570

No authentication is required to submit a form entry - the injection vector is the public-facing form submission endpoint, accessible by any unauthenticated visitor (CVSS PR:N). The site must have the Quill Forms plugin installed and active, running version 5.7.1 or earlier, with at least one published form or survey page accepting user input. Execution of the stored payload requires a subsequent visitor - ideally an authenticated user such as an administrator or editor - to view the page containing the injected response; passive viewing is sufficient, no additional click or interaction is required. Exploitation is limited to WordPress installations running the vulnerable plugin version; sites not using Quill Forms are unaffected. The primary limiting factor is the requirement for a victim to view the affected page, which, while not a high bar, distinguishes this from fully automated exploitation and means impact is deferred rather than immediate.

The provided CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N scores 7.2 (High), but the UI:N metric warrants scrutiny: stored XSS inherently requires a victim to view the injected page for the payload to execute, which NVD and most frameworks score as UI:R. Assigning UI:N inflates the score by roughly one point; a more conservative assessment yields approximately 6.1. Despite this, the S:C (scope change) and PR:N combination is genuinely dangerous - an unauthenticated attacker can inject a payload that later executes with the privileges of any authenticated user (including administrators) who views the page. No EPSS data was provided, no CISA KEV listing exists, and no POC has been publicly identified, all of which reduce immediate exploitation urgency. However, WordPress plugin XSS vulnerabilities in popular plugins are frequently targeted opportunistically by scanners, and the unauthenticated injection vector lowers the bar for mass exploitation significantly. Real-world risk is moderate-to-high for sites with active form usage where administrator or editor accounts regularly review submissions.

An unauthenticated attacker submits a crafted form entry containing a JavaScript payload (e.g., a cookie-stealing script) through a publicly accessible Quill Forms survey or quiz page. The payload is stored in the WordPress database without sanitization. When a site administrator subsequently logs in and reviews form submissions or visits a page embedding the injected form response, the script executes in their browser, exfiltrating the admin session cookie to an attacker-controlled server and enabling full account takeover.