CVE-2026-28568
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in Quill Forms versions up to 5.7.1.
Risk Assessment
An attacker can inject malicious JavaScript, potentially leading to session hijacking or content manipulation.
Recommendation
Update Quill Forms to the latest patched version.
Other vulnerabilities in Quill Forms
See all- CVE-2026-15664High
The Quill Forms plugin for WordPress in all versions up to and including 5.7.1 is vulnerable to Stored Cross-Site Scripting via the Multiple Choice 'Other' value. Insufficient input sanitization and output escaping allows unauthenticated attackers to inject arbitrary web scripts that execute in the WordPress admin results view.
- CVE-2026-75091High
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS