MW WP Form

Vulnerabilities

• CVE-2023-6316

  MW WP Form <= 5.0.1 - Unauthenticated Arbitrary File Upload

  Critical 9.8

• CVE-2023-6559

  MW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion

  Critical 9.8

• CVE-2026-5436

  MW WP Form <= 5.1.1 - Unauthenticated Arbitrary File Move via regenerate_upload_file_keys

  High 8.1

• CVE-2026-4347

  MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir

  High 8.1

• CVE-2026-48871

  WordPress MW WP Form plugin <= 5.1.3 - Cross Site Scripting (XSS) vulnerability

  High 7.1

• CVE-2024-24804

  WordPress MW WP Form Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)

  Medium 5.4

• CVE-2026-6206

  MW WP Form <= 5.1.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'post_id' Query Parameter

  Medium 5.3

• CVE-2023-46206

  WordPress MW WP Form plugin <= 4.4.5 - Broken Access Control vulnerability

  Medium 5.3

• CVE-2026-8853

  MW WP Form <= 5.1.3 - Authenticated (Editor+) Stored Cross-Site Scripting via 'memo' Parameter

  Medium 4.4