CVE-2026-5169
Stored XSS in Inquiry Form to Posts or Pages WordPress Plugin
Publication date: 2026-04-08
Last updated on: 2026-04-08
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordfence | inquiry_form_to_posts_or_pages | to 1.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Inquiry Form to Posts or Pages plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 1.0. This occurs because the plugin does not properly sanitize input when saving the 'Form Header' field and fails to escape output when displaying this stored value.
Specifically, the vulnerability exists in two places: on the plugin settings page where the value is inserted into an HTML attribute without proper escaping, and on the front-end shortcode output where the value is output in HTML content without escaping. This allows authenticated administrators to inject malicious scripts that execute when users view the settings page or any page containing the inquiry form shortcode.
How can this vulnerability impact me? :
This vulnerability can allow an attacker with administrator-level access to inject arbitrary malicious scripts into the plugin's 'Form Header' field. These scripts will execute in the browsers of users who visit the affected pages or the plugin settings page.
The impact includes potential theft of user credentials, session hijacking, defacement, or other malicious actions performed via the injected scripts. Since the attacker needs administrator privileges, the risk is limited to environments where such access is compromised or misused.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves stored Cross-Site Scripting (XSS) via the 'Form Header' field in the Inquiry Form to Posts or Pages WordPress plugin. Detection involves checking for malicious scripts stored in the plugin's settings or output.
Since the vulnerability is triggered by administrator-level users injecting scripts into the 'Form Header' field, detection can include reviewing the plugin settings for suspicious HTML or JavaScript code.
Specific commands are not provided in the available resources, but general approaches include:
- Manually inspecting the 'Form Header' field in the plugin settings page for suspicious script tags or unusual HTML.
- Using WP-CLI commands to export or view plugin options, for example: `wp option get <option_name>` to check stored values related to the plugin.
- Scanning the WordPress database for suspicious script tags in the options table where plugin settings are stored.
- Monitoring HTTP responses for injected scripts when accessing pages containing the [inquiry_form] shortcode.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediate steps include:
- Update the Inquiry Form to Posts or Pages plugin to a version later than 1.0 where the vulnerability is fixed.
- Restrict administrator-level access to trusted users only, as exploitation requires authenticated admin privileges.
- Manually sanitize or remove any suspicious content from the 'Form Header' field in the plugin settings.
- Avoid visiting the plugin settings page or pages containing the [inquiry_form] shortcode until the plugin is updated or the malicious content is removed.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated administrators to inject arbitrary scripts via stored cross-site scripting, which could lead to unauthorized access or manipulation of data when users access affected pages or plugin settings.
Such unauthorized script execution can potentially compromise the confidentiality and integrity of user data, which may impact compliance with data protection standards like GDPR and HIPAA that require safeguarding personal and sensitive information.
However, the provided information does not explicitly detail the direct impact on compliance with these regulations.