EUVD-2026-83574
GHSA-6hvq-jpx9-cm24
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLocate site with Quill Forms multiple-choice form
-
DeliverySubmit form with script in 'Other' value
-
ExploitPayload stored unsanitized in entry
-
ExecutionAdmin opens results view in wp-admin
-
PersistScript executes in admin session
-
ImpactAccount takeover / privilege escalation
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target WordPress site to run Quill Forms <=5.7.1 with a published form containing a Multiple Choice block that has the free-text 'Other' option enabled; the attacker (unauthenticated per PR:N) submits the form with a script payload in that 'Other' value. The critical limiting factor is that the injected script only executes when a privileged user - the administrator - subsequently opens the submitted-entries/results view in wp-admin (effectively requiring admin-side interaction), so impact is realized only upon entry review, not at submission time. |
| Impact | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High) describes a network-reachable, low-complexity, unauthenticated (PR:N) stored XSS with a scope change (S:C) reflecting execution in the WordPress admin context rather than the anonymous submission context. This is a genuine and realistic risk class: unauthenticated form submission plus a privileged victim (an administrator reviewing entries) is a well-established WordPress attack pattern reported repeatedly by Wordfence. However, the severity is tempered by real-world dependencies not captured in the raw score - the payload only fires when an admin opens the results/entry view, so it is not a fully autonomous server compromise. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or automated exploitation; this is a patch-on-normal-cadence issue rather than an emergency. Note also a mild vector tension: the CVSS uses UI:N even though exploitation practically requires an administrator to visit the entries page - arguably UI:R - which is a common Wordfence stored-XSS scoring convention. Overall: a real, credible admin-targeting stored XSS, but priority is moderate absent exploitation signals. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a Quill Forms multiple-choice form and enters a JavaScript payload into the free-text 'Other' option value, which is stored without adequate sanitization. When a site administrator later opens the form entries/results view in wp-admin, the payload executes in their authenticated session context, enabling actions such as creating rogue admin accounts, stealing nonces/cookies, or injecting further content. No public exploit code is identified at time of analysis, but the technique is trivial to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 19, 2026
Stored cross-site scripting in the Quill Forms WordPress plugin (Conversational Multi Step Forms, Surveys & Quizzes) through version 5.7.1 lets unauthenticated attackers inject arbitrary JavaScript into a form entry by abusing the free-text 'Other' option of a Multiple Choice block; the script is persisted server-side and executes in the browser of an administrator who later opens the submitted-entries/results view in wp-admin. The vulnerable path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High), with the scope change reflecting execution inside the privileged WordPress admin context rather than the anonymous submission context; the practical limitation is that impact only materializes when a privileged user reviews the affected entry, so administrator-side interaction effectively gates execution even though the vector scores UI:N. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so there is no confirmation of active exploitation.
RemediationAI
Upgrade the Quill Forms plugin past 5.7.1 as soon as the vendor publishes the fixed build; the provided data references an upstream Trac changeset (https://plugins.trac.wordpress.org/changeset?reponame=&old=3663009%40quillforms&new=3663009%40quillforms) indicating the code fix, but a specific released patched version is not independently confirmed here, so verify the current changelog on WordPress.org before assuming any given version is clean. If immediate upgrade is not possible, the most direct compensating control is to open each Multiple Choice block's configuration and disable the free-text 'Other' option, which removes the injection vector entirely at the cost of losing that answer choice for respondents; alternatively, unpublish or password/front-end restrict any forms using that block until patched, accepting a loss of data collection. Because the payload only detonates when an administrator opens the entries/results view, avoid bulk-reviewing unreviewed submissions in wp-admin until the plugin is fixed, and treat the entry list as untrusted content. The vendor advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/1261881f-7a04-47fb-8176-6a9ac2088f8d?source=cve should be monitored for the fixed version number; if patching is delayed, a WAF rule that rejects script-markup characters in submission payloads to the plugin's REST entry controller (class-rest-entry-controller.php) can reduce exposure but is bypassable and should not replace the upgrade.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Quill Forms is a PHP/JavaScript WordPress plugin that builds multi-step conversational forms, and the flaw is a classic CWE-79 improper neutralization of input during web page generation (stored XSS) in its submission and rendering pipeline. According to the referenced source locations in plugin tags 5.6.1 and 5.7.0 - includes/class-form-submission.php (lines 111, 194, 262), includes/blocks/multiple-choice/class-multiple-choice-block.php (line 199), includes/abstracts/class-block-type.php (line 402), and includes/rest-api/controllers/v1/class-rest-entry-controller.php (line 191) - the value entered into the Multiple Choice block's free-text 'Other' field is stored with the form entry and later emitted into the admin-facing entry/results view without adequate escaping (the save path also lacks sufficient sanitization). Because the entry data crosses trust boundaries from an anonymous public request into an authenticated admin dashboard, the CVSS scope is marked changed (S:C): the scripting context is the wp-admin origin, which carries administrator cookies and nonces. Exploitation prerequisites are structural rather than exotic - the site must run an affected version and must publish a form that uses a Multiple Choice block with the 'Other' option enabled - and the injected payload then lies dormant until an administrator renders the entry, at which point it executes with that user's session privileges. The reference set also includes a WordPress.org Trac changeset (3663009) pointing at the upstream code change.
Know when Wordpress Plugin gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated remote submission (PR:N, AV:N/AC:L); payload executes cross-context in the admin results view (S:C) with limited script-level confidentiality/integrity impact (C:L/I:L), no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes in the context of the WordPress admin results view, making administrators the primary target when reviewing submitted form entries.
Executive ViewAI
Sites running the Quill Forms WordPress plugin (through version 5.7.1) are exposed to stored cross-site scripting in which any anonymous visitor can plant malicious code inside a form submission, and that code then executes in an administrator's browser when an admin opens the entries or results view in wp-admin. Because the payload runs with administrator privileges, an attacker could hijack admin sessions, create rogue accounts, or alter site content and configuration - effectively handing over control of the website. No vendor patch is available, so the exposure will persist until compensating controls are in place.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the Quill Forms plugin where form capability is not essential; restrict wp-admin access by IP allowlist, enforce MFA, and apply least-privilege administrator roles; block administrators from opening the submissions/results view until remediated; disable or sanitize the Multiple Choice free-text 'Other' option; deploy WAF or virtual-patching rules that reject script payloads in form entry fields; and monitor admin sessions, form entries, and audit logs for anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Exploit-DB