CVE-2026-15664: Quill Forms WordPress Plugin XSS Vulnerability

CVE-2026-15664 Overview

CVE-2026-15664 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Quill Forms plugin for WordPress. The flaw affects all versions up to and including 5.7.1. Unauthenticated attackers can inject arbitrary JavaScript through the Multiple Choice block's Other value field due to insufficient input sanitization and output escaping. The injected payload executes in the WordPress admin results view when an administrator reviews submitted form entries.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript into form submissions that executes in the browser session of any administrator viewing the entries, enabling session theft, account takeover, or backend manipulation.

Affected Products

Quill Forms plugin for WordPress — all versions up to and including 5.7.1
Plugin marketed as Quill Forms | Conversational Multi Step Forms, Surveys & quizzes
WordPress sites exposing forms built with the vulnerable Multiple Choice block

Discovery Timeline

2026-09-19 - CVE-2026-15664 published to the National Vulnerability Database
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-15664

Vulnerability Analysis

The vulnerability resides in how the Quill Forms plugin processes the Other free-text option of the Multiple Choice block. When a respondent submits a form, the value supplied for the Other choice is stored in the plugin's entry storage without adequate sanitization. Later, when an administrator opens the entries view, the stored value is rendered into the admin page without proper HTML escaping. This produces a stored XSS primitive that crosses a security boundary from an unauthenticated public form submitter into an authenticated administrative session.

Because the injection sink lives in the WordPress admin results view, exploitation runs JavaScript with the privileges of the reviewing administrator. Actions available to that script include creating new administrator accounts, exfiltrating nonces, modifying plugin or theme files, and pivoting to further site compromise. The scope change reflected in the CVSS vector aligns with this cross-context execution.

Root Cause

The root cause is missing input sanitization on write and missing output escaping on render for the Multiple Choice Other value. Relevant code paths appear in includes/blocks/multiple-choice/class-multiple-choice-block.php, includes/abstracts/class-block-type.php, includes/class-form-submission.php, and includes/rest-api/controllers/v1/class-rest-entry-controller.php. The plugin treats the submitted string as safe display content instead of applying WordPress-native escaping helpers such as esc_html() or wp_kses() before rendering it in the entries UI.

Attack Vector

The attack requires no authentication and no user interaction from the attacker's side beyond submitting a public form. An attacker locates a WordPress site running Quill Forms with a Multiple Choice block that exposes an Other option. The attacker submits the form with an HTML/JavaScript payload placed in the Other value field. The payload is persisted in the entry store via the REST entry controller. When an administrator opens the submissions view, the browser parses the injected markup and executes the script in the administrator's authenticated session context.

See the Wordfence Vulnerability Report and the Quill Forms Multiple Choice Block source for the affected code paths.

Detection Methods for CVE-2026-15664

Indicators of Compromise

Form entries in the Quill Forms database tables containing <script>, onerror=, onload=, javascript:, or <svg sequences within Multiple Choice Other values.
New or unexpected WordPress administrator accounts created shortly after entries were reviewed.
Modifications to wp_options, active theme files, or plugin files that correlate in time with an admin viewing form submissions.
Outbound requests from an administrator's browser to unfamiliar domains immediately after opening the Quill Forms entries screen.

Detection Strategies

Query the plugin's entry storage for HTML tag characters and common XSS keywords in stored Multiple Choice values.
Review WordPress access logs for POST requests to the Quill Forms REST entry endpoint that contain URL-encoded <script> or event handler patterns.
Correlate administrator authentication events with subsequent privileged actions such as user_register, wp_insert_user, or plugin/theme file writes.

Monitoring Recommendations

Enable WordPress audit logging to capture administrative user changes, option updates, and file modifications.
Monitor web application firewall (WAF) telemetry for XSS signatures targeting Quill Forms submission endpoints.
Alert on any browser-side script errors or content security policy (CSP) violations reported from /wp-admin/ pages that render form entries.

How to Mitigate CVE-2026-15664

Immediate Actions Required

Upgrade the Quill Forms plugin to a version later than 5.7.1 as soon as a fixed release is available from the vendor.
Audit existing form entries and purge stored submissions containing HTML or script content in Multiple Choice Other fields.
Rotate credentials and session cookies for any administrator who reviewed submissions while the vulnerable version was installed.
Review WordPress user accounts and remove any unauthorized administrator accounts.

Patch Information

Refer to the Quill Forms changeset overview and the Wordfence advisory for the current patch status. Administrators should apply the vendor-supplied fixed version through the WordPress plugin updater once released.

Workarounds

Temporarily deactivate the Quill Forms plugin until a patched version is installed.
Disable or remove Multiple Choice blocks that expose the Other option on public forms.
Deploy a WAF rule to block submissions containing HTML tag characters in Quill Forms Other field parameters.
Enforce a strict Content Security Policy on /wp-admin/ to reduce inline script execution when reviewing entries.

bash

# Example WAF rule pattern (ModSecurity) to block HTML/script payloads
# targeting the Quill Forms REST submission endpoint
SecRule REQUEST_URI "@contains /wp-json/quillforms/v1/entries" \
  "chain,phase:2,deny,status:403,id:1026156640,\
   msg:'Potential XSS payload in Quill Forms submission (CVE-2026-15664)'"
  SecRule ARGS "@rx (?i)(<script|onerror\s*=|onload\s*=|javascript:|<svg\b)" \
    "t:none,t:urlDecodeUni,t:htmlEntityDecode"