CVE-2026-75091
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Risk Assessment
The risk includes execution of malicious scripts in visitors' browsers, which can lead to data theft, session hijacking, or malware distribution.
Recommendation
It is recommended to update the Quill Forms plugin to the latest version and implement additional security measures such as a Web Application Firewall.
Other vulnerabilities in Quill Forms
See all- CVE-2026-15664High
The Quill Forms plugin for WordPress in all versions up to and including 5.7.1 is vulnerable to Stored Cross-Site Scripting via the Multiple Choice 'Other' value. Insufficient input sanitization and output escaping allows unauthenticated attackers to inject arbitrary web scripts that execute in the WordPress admin results view.
- CVE-2026-28568High
Unauthenticated Cross Site Scripting (XSS) in Quill Forms versions up to 5.7.1.
Original NVD description (English source)
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS