CVE-2026-78364 MW WP Form CVE debrief

Who should care

Administrators and users of MW WP Form WordPress plugin, especially those with Editor or higher privileges, should be aware of this vulnerability. They should verify their plugin versions, restrict user roles, and monitor their admin dashboards for potential suspicious activity. Security teams and vulnerability management teams should also review the vulnerability and plan for mitigation or compensating controls if necessary.

Technical summary

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page. This could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin. The vulnerability is related to insufficient input validation and output encoding in the plugin's form settings handling.

Defensive priority

Low priority, verify MW WP Form plugin version and user roles.

Recommended defensive actions

• Verify MW WP Form plugin version is 5.1.6 or later
• Restrict user roles with Editor privileges
• Monitor admin dashboard for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence from WPScan suggests potential Stored Cross-Site Scripting vulnerability in MW WP Form WordPress plugin before version 5.1.6. Official CVE and NVD records provide additional context. The vulnerability is confirmed in versions prior to 5.1.6, but specific details about the exploitability and impacted configurations are limited. Defenders should verify MW WP Form plugin versions, review user roles, and monitor admin dashboard activity for suspicious behavior.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.