MW WP Form

MW WP Form has 13 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 13 are fixed as of October 2026. Their average CVSS score is 6.5, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 5 high. 2026 was the busiest year with 8 disclosures.

The most common weakness is Cross-Site Scripting, behind 5 of the records (38%). Other recurring categories include Path Traversal, Authorization Bypass Through User-Controlled Key.

Every one of the 13 issues recorded for MW WP Form has a vendor fix available, so running the current release closes all known holes.

13 independent researchers contributed these findings, one record each. MW WP Form is installed on roughly 200,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.4.13.

Strategic Overview

Avg CVSSMedium

6.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all MW WP Form vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2023-6316

MW WP Form <= 5.0.1 - Unauthenticated Arbitrary File Upload

Read the full analysis

Vulnerability Records

13 records


2026-10-01 19:20	MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta) MW WP Form <= 5.1.7	`CVE-2026-96567`	7.2 High	Kuba	Yes
2026-08-28 00:00	MW WP Form < 5.1.6 - Authenticated (Editor+) Stored Cross-Site Scripting MW WP Form < 5.1.6	`CVE-2026-78364`	4.4 Medium	Sai Praneeth Koti	Yes
2026-08-27 00:00	MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution MW WP Form < 5.1.5	`CVE-2026-78363`	6.5 Medium	Jakub Herman	Yes
2026-06-09 18:48	MW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter MW WP Form <= 5.1.3	`CVE-2026-8853`	4.4 Medium	Sérgio Charruadas (itzvenom)	Yes
2026-06-01 00:00	MW WP Form <= 5.1.3 - Unauthenticated Stored Cross-Site Scripting MW WP Form <= 5.1.3	`CVE-2026-48871`	7.2 High	VanTastic	Yes
2026-05-13 19:51	MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter MW WP Form <= 5.1.2	`CVE-2026-6206`	5.3 Medium	alex_henry20	Yes
2026-04-08 07:57	MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys MW WP Form <= 5.1.1	`CVE-2026-5436`	8.1 High	Sander Horsman	Yes
2026-04-01 16:50	MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir MW WP Form <= 5.1.0	`CVE-2026-4347`	8.1 High	ISMAILSHADOW	Yes
2024-01-31 00:00	MW WP Form <= 5.0.6 - Authenticated (Editor+) Stored Cross-Site Scripting MW WP Form <= 5.0.6	`CVE-2024-24804`	5.5 Medium	Huynh Tien Si	Yes
2023-12-15 00:00	MW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion MW WP Form <= 5.0.3	`CVE-2023-6559`	7.5 High	Thomas Sanzey	Yes

Showing 1–10 of 13 reports

Latestv5.1.8

MW WP Form

Author

Webの相談所

4.2(23)

84/100

Last Updated

2026-09-27 (1mo ago)

Active Installs

200,000+

Downloads

2,039,965

Requires WP

6.0+

Requires PHP

8.0+

Tested up to

WP 6.4.13

Created

2012-12-17 (14y ago)

This plugin currently has only the minimum required maintenance releases. Main maintainer has been handed over from @inc2734 to @websoudan. MW WP Form can create mail form with a confirmation screen using shortcode. Form created using shortcodes Using confirmation page is possible. The page changes by the same URL or individual URL are possible. Many validation rules Saving inquiry data is possible. Displaying Chart using saved inquiry data is possible. Official https://mw-wp-form.web-soudan.co.jp GitHub https://github.com/web-soudan/mw-wp-form The following third-party resources Google Charts Source: https://developers.google.com/chart/ Contributors Takashi Kitajima ( inc2734 ) Ryujiro Yamamoto ( ryu263 ) Tsujimoto Tomoyuki ( tomothumb ) [Naoyuki Ohata] ( nanniku ) Kazuto Takeshita ( moto hachi ) Atsushi Ando ( NExt-Season ) Kazuki Tomiyasu ( KUCKLU ) Kei Nomura ( mypacecreator ) mh35 Takashi Nojima herikutu tsucharoku Tetsuaki Hamano ( t-hamano ) Susumu Seino ( Susumu Seino ) Yosuke Onoue ( likr ) Yudai Konishi ( Yudai Konishi ) takekoshi ( takekoshi )

View on WordPress.org