This vulnerability (CVE-2026-48871) is an unauthenticated Cross-Site Scripting (XSS) flaw in MW WP Form versions <= 5.1.3. The issue arises from improper neutralization of input during web page generation, classified under CWE-79. The CVSS 3.1 base score is 7.1, indicating high severity, with attack vector network, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes limited confidentiality, integrity, and availability loss. No patch or official remediation level has been disclosed as of the publication date.

Successful exploitation allows unauthenticated attackers to inject malicious scripts into web pages generated by the vulnerable plugin, potentially leading to theft of user data, session hijacking, or other malicious actions affecting confidentiality, integrity, and availability to a limited extent. The vulnerability requires user interaction to trigger the payload and affects the security scope beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider applying temporary mitigations such as disabling the vulnerable plugin or restricting access to affected functionality. Monitor vendor channels for updates and apply patches promptly once available.