CVE-2026-96567 is a stored cross-site scripting vulnerability in the MW WP Form WordPress plugin affecting all versions up to 5.1.7. The vulnerability arises from improper neutralization of input in the 'post_id' parameter, leading to insufficient input sanitization and output escaping. Attackers can inject arbitrary web scripts that execute in the context of users visiting the injected pages. The CSRF protection mechanism (MW_WP_Form_Csrf) is bypassable by unauthenticated users who obtain a valid double-submit cookie by loading the public form page, removing effective protections against storing malicious payloads.

Successful exploitation allows unauthenticated attackers to inject and store malicious scripts that execute in users' browsers when they access the affected pages. This can lead to information disclosure and integrity impacts within the affected site context. The vulnerability has a CVSS v3.1 score of 7.2 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

No official patch or fix is currently documented for this vulnerability. Users should monitor the vendor's advisory for updates and apply any forthcoming patches promptly. Until a fix is available, consider disabling or restricting use of the MW WP Form plugin, especially on public-facing sites. Implementing additional web application firewall (WAF) rules to detect and block malicious payloads targeting the 'post_id' parameter may provide temporary mitigation.