Stored Cross-Site Scripting in MW WP Form Plugin by WordPress

CVE-2026-96567

What is CVE-2026-96567?

The MW WP Form plugin for WordPress is susceptible to Stored Cross-Site Scripting through the 'post_id' parameter due to inadequate input validation and output encoding. This vulnerability allows unauthenticated attackers to inject arbitrary scripts into web pages, resulting in script execution whenever a user visits the compromised page. Furthermore, the existing CSRF protections are ineffective, as unauthorized users can bypass them by simply loading the public form page, obtaining a valid double-submit cookie, and subsequently storing malicious content.

References