Cross-Site Request Forgery in Inquiry Form to Posts or Pages Plugin for WordPress

CVE-2026-6293

What is CVE-2026-6293?

The Inquiry Form to Posts or Pages plugin for WordPress is susceptible to Cross-Site Request Forgery, which can result in Stored Cross-Site Scripting. This vulnerability arises from the plugin's failure to implement nonce validation in its settings update handler. Without adequate nonce security, unauthenticated attackers can exploit this weakness by manipulating a logged-in Administrator into triggering a malicious action through a crafted request. The absence of input sanitization on user-supplied fields and the lack of output escaping when displaying stored data further amplifies the risk, permitting unauthorized script execution on affected sites.

References