CVE-2026-28568 HIGH

CVE-2026-28568: WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability

Vendor Mohamed Magdy

Product Quill Forms

Weakness CWE-79 · XSS

Published August 18, 2026

Last update August 18, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Quill Forms versions up to 5.7.1 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into form pages. An attacker can craft a malicious link or form that, when visited by a site visitor, executes JavaScript in their browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability requires user interaction and affects the scope beyond the vulnerable component.

What an attacker can do

03Attacker Capabilities

Inject and execute malicious JavaScript in visitors' browsers when they interact with affected forms.

Potential impact on your site

04Site Impact

Visitors' sessions, credentials, or personal data submitted via forms could be compromised or stolen.

Conditions required to exploit

05Prerequisites

Attacker must trick a site visitor into clicking a malicious link or visiting a compromised form page.

Key dates

06Disclosure timeline

August 18, 2026 CVE published

August 18, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-28568 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html AskarLabs — CWE-79 write-up Cross-Site Scripting

Related vulnerabilities