PT-2026-33008 · Udamadu · Inquiry Form To Posts/Pages
Published
2026-04-15
·
Updated
2026-04-15
·
CVE-2026-6293
CVSS v3.1
4.3
Medium
| AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in version 1.0. This is due to missing nonce validation on the plugin settings update handler, combined with insufficient input sanitization on all user-supplied fields and missing output escaping when rendering stored values. The settings handler fires solely on the presence of
$ POST['inq hidden'] == 'Y' with no call to check admin referer() and no WordPress nonce anywhere in the form or handler. This makes it possible for unauthenticated attackers to inject arbitrary web scripts via a forged request that tricks a logged-in Administrator into visiting a malicious page.Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Inquiry Form To Posts/Pages