CVE-2026-5169

The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Form Header' field in versions up to and including 1.0. This is due to insufficient input sanitization when saving via update_option() and lack of output escaping when displaying the stored value. The vulnerability exists in two locations: (1) the plugin settings page at inq_form.php line 180 where the value is echoed into an HTML attribute without esc_attr(), and (2) the front-end shortcode output at inquery_form_to_posts_or_pages.php line 139 where the value is output in HTML content without esc_html(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that will execute whenever a user accesses the plugin settings page or views a page containing the [inquiry_form] shortcode.

• CWE-79

• https://plugins.trac.wordpress.org/browser/inquiry-form-to-posts-or-pages/tags/1.0/inq_form.php#L180
• https://plugins.trac.wordpress.org/browser/inquiry-form-to-posts-or-pages/tags/1.0/inq_form.php#L63
• https://plugins.trac.wordpress.org/browser/inquiry-form-to-posts-or-pages/tags/1.0/inquery_form_to_posts_or_pages.php#L139
• https://plugins.trac.wordpress.org/browser/inquiry-form-to-posts-or-pages/trunk/inq_form.php#L180
• https://plugins.trac.wordpress.org/browser/inquiry-form-to-posts-or-pages/trunk/inq_form.php#L63
• https://plugins.trac.wordpress.org/browser/inquiry-form-to-posts-or-pages/trunk/inquery_form_to_posts_or_pages.php#L139
• https://www.wordfence.com/threat-intel/vulnerabilities/id/743788ed-bd40-4eb4-a27e-d4eb89df3a41?source=cve

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5162The Royal Addons for Elementor plugin for WordPress is vulne…6.4
• CVE-2026-5163Mattermost versions 11.5.x <= 11.5.1 fail to verify channel …6.5
• CVE-2026-5164A flaw was found in virtio-win. The `RhelDoUnMap()` function…5.5
• CVE-2026-5165A flaw was found in virtio-win, specifically within the Virt…7.8
• CVE-2026-5166Improper Limitation of a Pathname to a Restricted Directory …9.6
• CVE-2026-5167The Masteriyo LMS – Online Course Builder for eLearning, LMS…5.3
• CVE-2026-5170A user with access to the cluster with a limited set of priv…5.3
• CVE-2026-5171Improper access control in the entry activity log feature in…4.3
• CVE-2026-5172A buffer overflow in dnsmasq’s extract_addresses() function …7.3
• CVE-2026-5173GitLab has remediated an issue in GitLab CE/EE affecting all…8.5
• CVE-2026-5174Improper input validation vulnerability in Progress Software…8.8
• CVE-2026-5175Improper access control in the multi-factor authentication (…5