CVE-2026-75091 in Quill Forms Plugin
Summary
by MITRE • 08/18/2026
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The Quill Forms plugin for WordPress, specifically versions up through 5.7.1, contains a critical security flaw classified as Stored Cross-Site Scripting or XSS. This vulnerability stems from insufficient input sanitization and output escaping mechanisms within the application code. The core issue lies in the failure to properly validate user-supplied data before storing it in the database and subsequently rendering that data back into HTML contexts without adequate encoding. As a result, malicious actors can inject arbitrary JavaScript payloads into form submissions or survey responses which are then persisted on the server side rather than being executed immediately during input entry.
This stored nature of the vulnerability significantly amplifies its potential impact compared to reflected XSS attacks. Because the malicious script is saved within the application's data store, it will be served to every user who views the affected page containing the compromised form or quiz results. This creates a persistent threat vector where any visitor with access to the vulnerable pages becomes a potential victim of the injected code execution without needing direct interaction from the attacker beyond the initial injection point. The lack of authentication requirements for this exploit means that unauthenticated users on the public internet can trigger this vulnerability, making it particularly dangerous in environments where forms are accessible to anonymous visitors such as contact forms or public surveys.
From a technical perspective, the flaw aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The absence of proper output escaping allows raw script tags and event handlers to be interpreted by the victim's web browser rather than being displayed as plain text. This enables attackers to execute arbitrary commands within the context of the vulnerable website, effectively bypassing same-origin policy restrictions that normally isolate content from different sources. Consequently, an attacker can perform actions on behalf of authenticated users if they are logged in at the time of page access, steal session cookies or authentication tokens, redirect victims to phishing sites, or deface the web application interface.
The operational impact extends beyond simple script execution and includes potential compromise of user accounts and sensitive data exposure within the WordPress ecosystem. If an administrator views a compromised form submission while authenticated, their administrative privileges could be hijacked through cookie theft via JavaScript commands like document.cookie exfiltration scripts. This leads to CWE-200 where information from security features is exposed to unauthorized actors. Furthermore, persistent XSS can degrade trust in the website's integrity and reliability for legitimate users who encounter unexpected behavior or malicious redirects triggered by the injected code during normal navigation of the site.
Mitigation strategies must focus on immediate remediation through software updates and enhanced defensive coding practices. The primary recommendation is to upgrade the Quill Forms plugin to a version later than 5.7.1 where these sanitization issues have been addressed by the developers. In addition to updating, administrators should implement Web Application Firewall rules that detect and block common XSS payloads in form submission parameters. Input validation should enforce strict allow-listing of permitted characters for all user inputs while output encoding must ensure special HTML entities are properly escaped before rendering data back into browser contexts. Regular security audits using static analysis tools can help identify similar vulnerabilities across other plugins installed on the WordPress instance to prevent broader exploitation vectors aligned with ATT&CK techniques related to client-side injection and credential harvesting.