CVE-2026-48871: WordPress MW WP Form plugin <= 5.1.3 - Cross Site Scripting (XSS) vulnerability

Synopsis

This is a reflected or stored cross-site scripting (XSS) vulnerability in the MW WP Form WordPress plugin, versions 5.1.3 and earlier, developed by Takashi Kitajima. The flaw is reachable over the network with no authentication required, but a victim must interact with a malicious link or page for the attack to succeed. Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser, enabling session theft, page content manipulation, and limited availability impact. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched-image rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable WordPress site over the network; the plugin's XSS endpoint is exposed via standard HTTP/HTTPS traffic.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is exploitable by any unauthenticated network user.

• Victim interactionRequired

  A victim must click a crafted link or visit a malicious page that triggers the XSS payload in their browser session.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race conditions, or environmental factors to succeed.

Blast Radius

• Reads the victim's active session cookies or authentication tokens, enabling account takeover without needing the victim's password.
• Injects and executes arbitrary JavaScript in the victim's browser within the WordPress site's origin, allowing modification of visible page content.
• Exfiltrates form input data or other page content entered by the victim to an attacker-controlled server.
• Causes limited disruption to the victim's browsing session on the affected site, consistent with the CVSS availability impact rating of Low.