CVE-2026-8853 is a stored cross-site scripting vulnerability in the MW WP Form WordPress plugin affecting all versions up to 5.1.3. The vulnerability arises from improper neutralization of input in the 'memo' parameter, which is stored using update_post_meta() rather than wp_insert_post(). This storage method bypasses WordPress's built-in kses and unfiltered_html protections, allowing authenticated users with editor or higher privileges to inject arbitrary web scripts. These scripts execute whenever a user accesses the injected page, potentially compromising user interactions. The vulnerability has a CVSS 3.1 base score of 4.4, indicating medium severity, with network attack vector, high attack complexity, and requiring high privileges but no user interaction.

An attacker with editor-level or higher privileges can inject malicious scripts into pages via the 'memo' parameter. These scripts execute in the context of users viewing the affected pages, potentially leading to information disclosure or session hijacking. The vulnerability does not affect availability and has limited impact on confidentiality and integrity as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor-level access to trusted users only and monitor for suspicious activity related to the MW WP Form plugin. Avoid using the 'memo' parameter for untrusted input. Follow vendor updates for patches or official mitigations.