The 'Inquiry form to posts or pages' WordPress plugin suffers from a stored XSS vulnerability due to insufficient sanitization of the 'Form Header' field. Specifically, the plugin fails to properly escape this input when saving via update_option() and when outputting it in two locations: the plugin settings page (inq_form.php line 180) and the front-end shortcode output (inquery_form_to_posts_or_pages.php line 139). This allows authenticated users with administrator privileges to inject arbitrary JavaScript that executes in the context of users viewing affected pages or the settings page. The vulnerability is tracked as CVE-2026-5169 with a CVSS 3.1 score of 4.4 (medium severity). No patch or official fix is currently documented.

An attacker with administrator-level access can exploit this vulnerability to inject and execute arbitrary JavaScript code in the context of users viewing the plugin settings page or pages containing the shortcode. This could lead to actions such as session hijacking, defacement, or other malicious activities limited by the scope of the XSS. The impact is limited by the requirement for administrator privileges to inject the payload and the medium CVSS score reflects this.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrator access to trusted users only and consider removing or disabling the plugin if feasible. Monitor official vendor channels for updates or patches addressing this vulnerability.