CVE-2026-78363

MediumCVSS 4.8/10Last modified Sep 1, 2026

Description

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation requires the site to have been configured to echo a submitted value back to the visitor after submission.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
Unknown	MW WP Form	< 5.1.5

References

https://wpscan.com/vulnerability/0569c5f7-2001-4364-a68b-451b73f3a32a/

Timeline

Published: Sep 1, 2026
Last modified: Sep 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-783643.5The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin CVE-2026-783659.3Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticate CVE-2026-783677.0A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools CVE-2026-783698.8RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administr CVE-2026-78373.7A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operat CVE-2026-783709.2RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retriev CVE-2026-783715.9The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is CVE-2026-783729.2RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unaut CVE-2026-783746.9Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor CVE-2026-783758.6Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6 CVE-2026-783768.8A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result CVE-2026-783776.1URL redirection to untrusted site ('open redirect') vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Syst