CVE-2026-8853

A vulnerability exists in the MW WP Form plugin for WordPress, affecting versions up to 5.1.3, which allows authenticated attackers with editor-level access or higher to inject malicious web scripts into pages. This is due to inadequate input validation and output escaping, enabling the injection of arbitrary web scripts that will execute when accessed by users. As a result, attackers can bypass WordPress's built-in security protections and inject scripts that escape the textarea element, regardless of the user's role-based content filtering settings.

Based on public CVE data (MITRE/NVD).