PT-2026-31103 · Udamadu · Inquiry Form To Posts/Pages
Published
2026-04-08
·
Updated
2026-04-08
·
CVE-2026-5169
CVSS v3.1
4.4
Medium
| AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N |
The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Form Header' field in versions up to and including 1.0. This is due to insufficient input sanitization when saving via update option() and lack of output escaping when displaying the stored value. The vulnerability exists in two locations: (1) the plugin settings page at inq form.php line 180 where the value is echoed into an HTML attribute without esc attr(), and (2) the front-end shortcode output at inquery form to posts or pages.php line 139 where the value is output in HTML content without esc html(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that will execute whenever a user accesses the plugin settings page or views a page containing the [inquiry form] shortcode.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Inquiry Form To Posts/Pages