Description

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected script executes in the context of the WordPress admin results view, making administrators the primary target when reviewing submitted form entries.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-19T08:16:52.763Z",
  "pubdate": "2026-09-19T08:16:52.763Z",
  "executiveSummary": "The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability due to improper input sanitization and output escaping. This security flaw resides in the handling of the 'Other' value option within Multiple Choice form fields.\nThe vulnerability allows unauthenticated remote attackers to inject malicious JavaScript payloads into submitted form data. When a WordPress administrator accesses the plugin's submission review interface, the injected script executes within the context of the administrator's session. This elevates the risk of administrative account compromise, session hijacking, or unauthorized configuration changes within the WordPress environment.\nBecause the execution occurs in the administrative dashboard, the impact is significant, potentially allowing attackers to gain full control over the WordPress installation. There are no authentication requirements to perform the initial injection, making this an accessible vector for automated exploitation attempts targeting plugin users.",
  "technicalDetails": "The vulnerability originates from a failure in the plugin to properly sanitize user-supplied data provided through the 'Other' input field in Multiple Choice components. The application accepts this input and stores it directly in the database without applying sufficient output encoding before rendering the data in the administrative backend.\nThe attack flow begins with an unauthenticated attacker interacting with a public-facing form generated by Quill Forms. By selecting the 'Other' option, the attacker provides a crafted payload containing malicious JavaScript (e.g., <script>alert(document.cookie)</script>) instead of a legitimate text value. This payload is then submitted and committed to the database associated with the form results.\nThe primary vulnerable component is the administrative results view, which displays form entries to users with administrative privileges. When the administrator navigates to the 'Results' section of the plugin to review the submissions, the application retrieves the malicious entry from the database and renders it directly into the HTML of the admin dashboard without applying contextual output escaping. Consequently, the browser interprets the injected payload as executable script rather than plain text.\nBecause the script executes in the context of the WordPress admin panel, it inherits the permissions of the authenticated administrator. This provides an attacker with the ability to perform any action the administrator can perform, such as modifying plugin settings, creating new administrative users, or injecting malicious code into theme files. The attack is persistent; every time an administrator views the compromised entry, the payload executes. This vulnerability affects all versions of Quill Forms up to, and including, version 5.7.1."
}