Executive Summary

The MW WP Form plugin for WordPress has a Stored Cross-Site Scripting (XSS) vulnerability in the 'memo' parameter in all versions up to and including 5.1.3. This occurs because the plugin does not properly sanitize input or escape output for this parameter.

Authenticated users with editor-level access or higher can inject malicious web scripts into pages via the 'memo' parameter. These scripts execute whenever any user accesses the affected page.

The vulnerability exists because the memo value is stored using update_post_meta() instead of wp_insert_post(), which bypasses WordPress's built-in protections like kses and unfiltered_html. This allows attackers to break out of the textarea element using injected closing tags, regardless of role-based content filtering.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers with editor-level access or higher to inject malicious scripts into WordPress pages, which will execute in the browsers of users who visit those pages.

The impact includes potential theft of user credentials, session hijacking, defacement of the website, or redirection to malicious sites.

Because the vulnerability requires high privileges (editor or above) and has a CVSS base score of 4.4, the risk is moderate but still significant for sites with multiple editors or administrators.

Useful 0 Not Useful 0