CVE-2026-5169
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Stored Cross-Site Scripting vulnerability in the Inquiry Form to Posts or Pages plugin for WordPress up to version 1.0. The 'Form Header' field is insufficiently sanitized and escaped, allowing authenticated admin-level attackers to inject arbitrary scripts that execute on the plugin settings page or pages with the [inquiry_form] shortcode.
Risk Assessment
An admin attacker can inject malicious scripts that execute in browsers of other admins or visitors, potentially leading to data theft or session hijacking.
Recommendation
Update the Inquiry Form to Posts or Pages plugin to a version higher than 1.0 or apply appropriate security patches.
Original NVD description (English source)
The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Form Header' field in versions up to and including 1.0. This is due to insufficient input sanitization when saving via update_option() and lack of output escaping when displaying the stored value. The vulnerability exists in two locations: (1) the plugin settings page at inq_form.php line 180 where the value is echoed into an HTML attribute without esc_attr(), and (2) the front-end shortcode output at inquery_form_to_posts_or_pages.php line 139 where the value is output in HTML content without esc_html(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that will execute whenever a user accesses the plugin settings page or views a page containing the [inquiry_form] shortcode.