Stored Cross-Site Scripting in MW WP Form Plugin for WordPress
CVE-2026-8853
4.4MEDIUM
What is CVE-2026-8853?
The MW WP Form plugin for WordPress suffers from a Stored Cross-Site Scripting issue through the 'memo' parameter, present in all versions up to 5.1.3. Due to inadequate input sanitization and output escaping, authenticated attackers with editor-level access can inject arbitrary web scripts that execute when another user accesses the compromised page. The vulnerability arises because the memo value is saved via update_post_meta(), bypassing WordPress's kses and unfiltered_html safeguards. This flaw enables attackers to manipulate the textarea element, exposing users to potential attacks regardless of existing role-based content filtering.
Affected Version(s)
MW WP Form 0 <= 5.1.3