UNKNOWN NVD

CVE-2026-78364

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, whic

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

References

https://wpscan.com/vulnerability/285b87e1-110f-4192-a098-e64e2eb447a8/

Published: 2026-08-30 · Source: NVD · Feed updated: 2026-08-30

This unknown severity vulnerability was published on 2026-08-30 via NVD.

vulnfeed aggregates 11450 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.