CVE-2026-78364

LowCVSS 3.5/10Last modified Aug 31, 2026

Description

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Unknown	MW WP Form	< 5.1.6

References

https://wpscan.com/vulnerability/285b87e1-110f-4192-a098-e64e2eb447a8/

Timeline

Published: Aug 30, 2026
Last modified: Aug 31, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-783659.3Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticate CVE-2026-783677.0A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools CVE-2026-783698.8RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administr CVE-2026-78373.7A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operat CVE-2026-783709.2RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retriev CVE-2026-783715.9The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is CVE-2026-783729.2RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unaut CVE-2026-783746.9Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension < 2.3.0 - The front-end JSON editor CVE-2026-783758.6Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6 CVE-2026-783768.8A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result CVE-2026-783776.1URL redirection to untrusted site ('open redirect') vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Syst CVE-2026-783786.9Ransomlook contains a Redis glob pattern injection vulnerability caused by insufficient neutralization of user-controlled input before it is