Skip to content
Sign in
4.8 Medium

CVE-2026-78363 The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed…

Description

The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation requires the site to have been configured to echo a submitted value back to the visitor after submission.

Affected products and versions

Product Affected versions Fixed in
MW WP Form 5.1 earliest → < 5.1.5 5.1.5

Other CVEs of MW WP Form

The 2 CVEs of MW WP Form →
CVE-2026-78364 The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting… 3.5 Low
Track this CVE