CVE-2026-75091: Quill Forms WordPress Plugin XSS Vulnerability

CVE-2026-75091 Overview

CVE-2026-75091 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Quill Forms plugin for WordPress. The flaw impacts all versions up to and including 5.7.1. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts into pages served by vulnerable sites. Injected payloads execute in the browser of any user who accesses an affected page. The vulnerability is tracked under [CWE-79] and carries a network attack vector requiring no authentication or user interaction.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads that execute against every visitor and administrator of an affected WordPress site.

Affected Products

Quill Forms | Conversational Multi Step Forms, Surveys & Quizzes plugin for WordPress
All plugin versions up to and including 5.7.1
WordPress sites with the Quill Forms plugin installed and active

Discovery Timeline

2026-08-18 - CVE-2026-75091 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75091

Vulnerability Analysis

The Quill Forms plugin accepts form input from unauthenticated users and stores it for later rendering in the WordPress front-end and administrative context. The plugin fails to sanitize inbound values on write and does not escape stored values on output. As a result, attacker-controlled markup and JavaScript persist in the database and execute when pages containing the injected content are rendered.

Because the injection is persistent and reaches viewers who never interacted with the attacker, exploitation scales to every visitor of an affected page. The changed scope in the CVSS vector reflects that impact crosses the trust boundary from the vulnerable plugin into the surrounding WordPress session context.

Root Cause

The underlying weakness is a Cross-Site Scripting flaw classified as [CWE-79]. Form field values submitted through the plugin are neither filtered against an allow-list of safe characters on input nor escaped through WordPress helpers such as esc_html(), esc_attr(), or wp_kses_post() on output. Untrusted input reaches the rendered Document Object Model as executable script.

Attack Vector

An unauthenticated attacker submits a crafted payload through a Quill Forms form field or an equivalent stored input surface exposed by the plugin. The payload is written to the WordPress database. When an administrator reviews submissions or a visitor loads a page that reflects the stored content, the browser parses the injected <script> or event handler and runs it in the site's origin.

Typical post-exploitation actions include session cookie theft, administrator account takeover through forced actions, injection of secondary payloads, and redirection to attacker-controlled infrastructure. Refer to the Wordfence Vulnerability Report and the Patchstack XSS Vulnerability Analysis for additional technical context.

Detection Methods for CVE-2026-75091

Indicators of Compromise

Form submission records containing <script>, onerror=, onload=, javascript:, or encoded variants stored in Quill Forms entries or WordPress post metadata.
Unexpected outbound requests from administrator browsers to unfamiliar domains shortly after viewing form entries or plugin admin pages.
New or modified WordPress administrator accounts, plugin installations, or theme file changes correlating with visits to pages that render Quill Forms content.

Detection Strategies

Query the WordPress database for stored form submissions containing HTML tags, event handlers, or protocol handlers indicative of script injection.
Deploy Web Application Firewall (WAF) rules that flag POST requests to Quill Forms endpoints containing XSS payload signatures.
Review server access logs for repeated form submissions from a single source with anomalous payload lengths or encoded content.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture script execution violations across the WordPress front-end and wp-admin.
Alert on administrator sessions originating from unusual geolocations or user agents following exposure to injected pages.
Continuously inventory installed WordPress plugins and their versions to identify hosts still running Quill Forms 5.7.1 or earlier.

How to Mitigate CVE-2026-75091

Immediate Actions Required

Update the Quill Forms plugin to a version later than 5.7.1 as soon as a patched release is published by the vendor.
Audit existing form submissions and post content for stored JavaScript payloads and remove any malicious entries.
Rotate WordPress administrator credentials and invalidate active sessions if the plugin was exposed to untrusted traffic.

Patch Information

No fixed version is listed in the enriched CVE data at the time of publication. Monitor the Patchstack advisory and the Wordfence advisory for the vendor-issued patched version, then apply it across all affected WordPress deployments.

Workarounds

Deactivate and remove the Quill Forms plugin until a patched release is available if forms are not business-critical.
Restrict access to pages that embed Quill Forms using authentication or IP allow-listing while a fix is pending.
Deploy a Web Application Firewall with virtual patching signatures for stored XSS targeting the plugin's submission endpoints.
Enforce a strict Content-Security-Policy header that blocks inline scripts and untrusted external sources to reduce payload execution.

bash

# Configuration example: strict CSP header in an Nginx site block
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;