CVE-2026-78364: CWE-79 Cross-Site Scripting (XSS) in MW WP Form

The MW WP Form WordPress plugin versions prior to 5.1.6 contain a stored XSS vulnerability (CWE-79) due to insufficient sanitization and escaping of form settings output in the admin dashboard. This vulnerability enables users with Editor roles to inject malicious JavaScript code that executes when viewed by administrators or other high-privilege users, potentially leading to session hijacking or other script-based attacks. The CVSS v3.1 base score is 3.5, indicating a low severity with network attack vector, low attack complexity, high privileges required, and user interaction needed.

An attacker with Editor privileges can exploit this vulnerability to perform stored cross-site scripting attacks against administrators or other high-privilege users. This could lead to limited confidentiality and integrity impacts, such as theft of session tokens or unauthorized actions performed in the context of the victim user. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Editor role assignments to trusted users and consider limiting access to the affected plugin's settings pages. Monitor vendor channels for updates and apply patches promptly once released.