CVE-2026-78364

Name of the Vulnerable Software and Affected Versions MW WP Form versions prior to 5.1.6

Description Insufficient sanitization and escaping of form settings before they are output on an admin dashboard page allows users with Editor privileges or higher to execute Stored Cross-Site Scripting (XSS) attacks against high-privilege users, such as administrators. Stored XSS occurs when a malicious script is permanently stored on the target server and later executed in the browser of a victim viewing the affected page.

Recommendations Update MW WP Form to version 5.1.6 or later.