Junglewise Threat Intelligence

CVE-2026-5169: udamadu Inquiry Form to Posts or Pages Stored XSS in Form Header

CVE-2026-5169 · Severity: medium · CVSS 4.4 · Published 2026-04-08

Executive brief

The Inquiry Form to Posts or Pages plugin for WordPress, which allows site owners to add contact forms to their content, contains a security flaw in how it handles form headers. An attacker with administrative access can save malicious scripts into the plugin settings. These scripts will then execute in the browsers of other users who visit the settings page or view pages where the inquiry form is displayed, potentially leading to unauthorized actions or data theft.

Technical details

The Inquiry Form to Posts or Pages plugin for WordPress (up to version 1.0) is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization and output escaping of the 'Form Header' field. Specifically, the value is saved using update_option() without sanitization and later rendered in inq_form.php (line 180) and inquery_form_to_posts_or_pages.php (line 139) without using esc_attr() or esc_html(). An authenticated attacker with administrator privileges can exploit this to inject arbitrary web scripts. These scripts execute in the context of any user session—including other administrators—who accesses the plugin's settings page or any front-end page containing the [inquiry_form] shortcode.

Affected products

  • udamadu Inquiry form to posts or pages <= 1.0

Timeline

  • 2026-04-08: disclosed: Initial disclosure by Wordfence
  • 2026-04-08: advisory: NVD publication date

References