# CVE-2026-78364: MW WP Form Stored XSS in admin form settings

Source: https://junglewise.ai/threats/cve-2026-78364-mw-wp-form-stored-xss-in-admin-form-settings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-30. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78364 · Severity: low · CVSS 3.5 · Published 2026-08-30

The MW WP Form WordPress plugin fails to properly sanitize and escape form configuration settings before displaying them in the admin dashboard. An attacker with Editor-level access can inject malicious JavaScript code into form settings, which executes when administrators view the saved form submissions. This allows unauthorized code execution in the admin's browser session, potentially leading to account compromise or data theft.

## Quick answers

**Is CVE-2026-78364 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78364 being exploited in the wild.

**How severe is CVE-2026-78364?** Low severity, with a CVSS score of 3.5, published 30 August 2026.

**Which products and versions are affected?** MW WP Form MW WP Form before 5.1.6.

**Is there a fix for CVE-2026-78364?** A patch was published on 2026-08-30: Fixed in version 5.1.6 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78364 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78364?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a Stored Cross-Site Scripting (XSS) vulnerability in the MW WP Form WordPress plugin versions before 5.1.6. The vulnerability exists in the form settings storage mechanism, specifically in the "Admin Email Options" and inquiry data list display. An authenticated user with Editor or higher role can inject malicious JavaScript via form configuration fields (the "To" email address and column header templates), which is stored in the database without proper sanitization. When an administrator views the inquiry data list on the dashboard, the unsanitized settings are rendered as HTML, causing the injected script to execute in the admin's session. The vulnerability requires admin interaction (viewing the entries list) and allows arbitrary JavaScript execution within the administrator's authenticated context. A patch is available in version 5.1.6 and later.

## Affected products

- MW WP Form MW WP Form before 5.1.6

## Timeline

- 2026-08-28: disclosed
- 2026-08-30: patched: Fixed in version 5.1.6

## References

- [https://wpscan.com/vulnerability/285b87e1-110f-4192-a098-e64e2eb447a8/](https://wpscan.com/vulnerability/285b87e1-110f-4192-a098-e64e2eb447a8/)