Threat database

The MW WP Form WordPress plugin versions up to and including 5.1.7 contain a stored cross-site scripting (XSS) vulnerability via the 'post_id' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The plugin's CSRF protection can be bypassed by unauthenticated visitors, enabling the storage of malicious payloads without effective barriers.

The MW WP Form WordPress plugin versions up to and including 5.1.3 contain a stored cross-site scripting (XSS) vulnerability via the 'memo' parameter. Authenticated users with editor-level or higher privileges can inject malicious scripts that execute when other users view the affected pages. This occurs because input sanitization and output escaping are insufficient, and WordPress's usual protections do not apply due to how the memo data is stored.

The MW WP Form plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.1.2 via the _get_post_property_from_querystring() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract data from password protected, private, or draft posts that they should not have access to.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in websoudan MW WP Form allows Stored XSS.This issue affects MW WP Form: from n/a through 5.0.6.