High severity · published Oct 2, 2026
CVE-2026-96567
MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)
7.2
CVSS
0.3%
EPSS
No
On KEV
Description
The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including, 5.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The CSRF gate protecting form submission (MW_WP_Form_Csrf) is bypassable by any unauthenticated visitor who first loads the public form page to obtain a valid double-submit cookie, leaving no effective barrier to storing malicious payloads.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MW
MW WP Form · websoudan
through 5.1.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-96567
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-96567
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/060ff51b-536d-4022-a68a-f77dc6c9c814?source=cve
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/models/class.parser.php#L208
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/models/class.parser.php#L156
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/services/class.exec-shortcode.php#L151
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/services/class.exec-shortcode.php#L122
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/mw-wp-form/tags/5.1.6/classes/models/class.contact-data-setting.php#L200
More from MW WP Form
5.3
CVE-2026-92086
MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter
5.3
CVE-2026-6206
MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter
4.4
CVE-2026-8853
MW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter