CVE-2026-75091 is a stored cross-site scripting vulnerability in the mdmag Quill Forms plugin for WordPress. It affects all versions from 0 up to and including 5.7.1. The root cause is improper neutralization of input during web page generation, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users visiting the affected pages, potentially leading to information disclosure or session hijacking. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impact on confidentiality and integrity with no availability impact.

An unauthenticated attacker can inject and store malicious scripts within the plugin's pages, which execute when other users access those pages. This can lead to unauthorized disclosure of information and modification of data within the user's browser context. There is no direct impact on system availability. The vulnerability can be exploited remotely without any authentication or user interaction.

No explicit patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling the plugin or restricting access to affected pages to trusted users only.