EUVD-2026-68158
GHSA-88rf-74wh-96q8
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Editor role is PR:L not PR:H; scope changes to admin browser (S:C) since a different security principal is the victim.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.
AnalysisAI
Stored XSS in the MW WP Form WordPress plugin (all versions before 5.1.6) lets authenticated users holding the Editor role or above inject persistent malicious JavaScript into form settings, which then executes in the browser of any administrator who views the affected dashboard page. A publicly available proof-of-concept has been published by WPScan, though EPSS sits at 0.15% (5th percentile), indicating low measured exploitation probability at this time. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress user account with the Editor role or higher - unauthenticated attackers cannot exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The aggregate signal picture here is notably split. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update MW WP Form to version 5.1.6 or later, which introduces proper sanitization and escaping of form settings before rendering in the admin dashboard. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mw Wp Form
View allUnrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a remo
Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to
Shortcode injection in MW WP Form WordPress plugin (versions before 5.1.5) allows unauthenticated remote attackers to ex
The MW WP Form plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 5.0.3
Arbitrary file manipulation in MW WP Form plugin (WordPress) versions ≤5.1.1 allows unauthenticated attackers to move se
Reflected or stored Cross-Site Scripting in the MW WP Form WordPress plugin (versions <= 5.1.3) allows remote unauthenti
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in websoudan MW WP Fo
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today