CVE-2026-15664
HighCVSS 7.2Summary
The Quill Forms plugin for WordPress in all versions up to and including 5.7.1 is vulnerable to Stored Cross-Site Scripting via the Multiple Choice 'Other' value. Insufficient input sanitization and output escaping allows unauthenticated attackers to inject arbitrary web scripts that execute in the WordPress admin results view.
Risk Assessment
An unauthenticated attacker can inject a malicious script that executes in the browser of an administrator reviewing form submissions. This may lead to admin session theft, account takeover, and full site compromise.
Recommendation
Update the Quill Forms plugin to a version newer than 5.7.1 as soon as it becomes available. Until a fix is released, consider disabling the plugin or restricting who can review submissions, and deploy additional protections (e.g., a WAF).
Other vulnerabilities in Quill Forms
See all- CVE-2026-28568High
Unauthenticated Cross Site Scripting (XSS) in Quill Forms versions up to 5.7.1.
- CVE-2026-75091High
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes in the context of the WordPress admin results view, making administrators the primary target when reviewing submitted form entries.