CVE-2026-5169 udamadu CVE debrief

Who should care

Administrators of WordPress installations with the Inquiry Form to Posts or Pages plugin version 1.0 or earlier should prioritize updating to a patched version. This requires coordination with relevant IT teams to ensure timely patching and minimize potential impact. Additionally, security teams should review and sanitize all input fields in the plugin settings and implement output escaping for stored values.

Technical summary

The vulnerability exists in two locations: (1) the plugin settings page at inq_form.php line 180 where the value is echoed into an HTML attribute without esc_attr(), and (2) the front-end shortcode output at inquery_form_to_posts_or_pages.php line 139 where the value is output in HTML content without esc_html(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that will execute whenever a user accesses the plugin settings page or views a page containing the [inquiry_form] shortcode.

Defensive priority

Medium priority given the CVSS score of 4.4 and the requirement for administrator-level access to exploit.

Recommended defensive actions

• Update the Inquiry Form to Posts or Pages plugin to a version beyond 1.0.
• Review and sanitize all input fields in the plugin settings.
• Implement output escaping for stored values in the plugin.
• Monitor for suspicious activity on the plugin settings page and front-end shortcode output.
• Consider implementing a Web Application Firewall (WAF) to detect and prevent cross-site scripting attacks.

Evidence notes

The CVE record was published on 2026-04-08T07:16:23.030Z and was last modified on 2026-07-24T20:10:00.147Z. The vulnerability was reported by [email protected]. Evidence is limited to the CVE record and NVD detail page. Defenders should verify the affected scope and severity based on the official advisory and review context for potential impact on their environments.

Official resources