CVE-2026-8853

Name of the Vulnerable Software and Affected Versions MW WP Form versions prior to 5.1.4

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with editor-level access or higher can inject arbitrary web scripts into pages. This is possible because the memo parameter is stored using the update post meta() function instead of wp insert post(), which bypasses WordPress's built-in kses and unfiltered html protections. Consequently, attackers can use injected closing tags to break out of the textarea element, regardless of role-based content filtering.

Recommendations Update to a version later than 5.1.3. As a temporary workaround, restrict access to the memo parameter for users with editor-level permissions until the update is applied.