Quill Forms Conversational Multi Step Forms Surveys Quizzes
Monthly
Stored cross-site scripting in the Quill Forms WordPress plugin (Conversational Multi Step Forms, Surveys & Quizzes) through version 5.7.1 lets unauthenticated attackers inject arbitrary JavaScript into a form entry by abusing the free-text 'Other' option of a Multiple Choice block; the script is persisted server-side and executes in the browser of an administrator who later opens the submitted-entries/results view in wp-admin. The vulnerable path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High), with the scope change reflecting execution inside the privileged WordPress admin context rather than the anonymous submission context; the practical limitation is that impact only materializes when a privileged user reviews the affected entry, so administrator-side interaction effectively gates execution even though the vector scores UI:N. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so there is no confirmation of active exploitation.
Stored Cross-Site Scripting in the Quill Forms WordPress plugin (all versions through 5.7.1) enables unauthenticated attackers to permanently inject arbitrary JavaScript into pages rendered by the plugin. The CVSS vector (PR:N, S:C) confirms no authentication is needed to plant the payload, and the scope change indicates injected scripts execute in victims' browser sessions - enabling session hijacking, credential theft, or admin account takeover when privileged users view affected pages. Reported by Wordfence and corroborated by Patchstack; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the Quill Forms WordPress plugin (Conversational Multi Step Forms, Surveys & Quizzes) through version 5.7.1 lets unauthenticated attackers inject arbitrary JavaScript into a form entry by abusing the free-text 'Other' option of a Multiple Choice block; the script is persisted server-side and executes in the browser of an administrator who later opens the submitted-entries/results view in wp-admin. The vulnerable path is reachable without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, 7.2 High), with the scope change reflecting execution inside the privileged WordPress admin context rather than the anonymous submission context; the practical limitation is that impact only materializes when a privileged user reviews the affected entry, so administrator-side interaction effectively gates execution even though the vector scores UI:N. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so there is no confirmation of active exploitation.
Stored Cross-Site Scripting in the Quill Forms WordPress plugin (all versions through 5.7.1) enables unauthenticated attackers to permanently inject arbitrary JavaScript into pages rendered by the plugin. The CVSS vector (PR:N, S:C) confirms no authentication is needed to plant the payload, and the scope change indicates injected scripts execute in victims' browser sessions - enabling session hijacking, credential theft, or admin account takeover when privileged users view affected pages. Reported by Wordfence and corroborated by Patchstack; no public exploit code or CISA KEV listing has been identified at time of analysis.