Description

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-18T06:16:44.227Z",
  "pubdate": "2026-08-18T06:16:44.227Z",
  "executiveSummary": "The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is affected by a Stored Cross-Site Scripting (XSS) vulnerability across all versions up to, and including, 5.7.1. This security flaw stems from inadequate input sanitization and improper output escaping mechanisms within the plugin's handling of user-supplied data. The vulnerability allows unauthenticated remote threat actors to inject malicious scripts, typically JavaScript, into application pages where the input is subsequently rendered. When unsuspecting users or administrators access the compromised page containing the injected payload, the malicious script executes within the context of the victim's browser session. This can lead to severe security implications, including session hijacking, unauthorized access to sensitive application data, credential theft, and unauthorized administrative actions performed on behalf of the authenticated user. Because the attack vector requires no prior authentication or elevated privileges, it poses a significant risk to the integrity and confidentiality of vulnerable WordPress installations utilizing the affected plugin versions.",
  "technicalDetails": "The vulnerability resides within the Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress, specifically in versions up to, and including, 5.7.1. The root cause of the vulnerability is the lack of robust input sanitization and context-aware output escaping for user-controlled input processed and stored by the plugin. When form submissions, survey responses, or related multi-step form data are accepted by the application, the underlying functions fail to adequately strip or neutralize executable HTML and JavaScript constructs before committing the data to the database.\nThe attack flow begins when an unauthenticated attacker crafts a malicious HTTP request containing arbitrary web scripts embedded within input fields processed by the vulnerable plugin. Due to the absence of strict input validation, the payload is successfully accepted and stored persistently in the database. When a legitimate user or administrator navigates to the affected page where the stored data is dynamically retrieved and rendered to the Document Object Model (DOM), the unescaped payload is interpreted and executed by the browser.\nBecause the execution occurs directly within the client-side environment of the victim, the malicious script inherits the victim's session privileges and access rights. If the victim accessing the injected page holds administrative privileges, the attacker can leverage the XSS payload to perform actions such as creating new administrative accounts, modifying site configurations, or deploying further web shells. The vulnerability is accessible over the network without requiring any authentication or specific user privileges, lowering the attack complexity and enabling automated exploitation by external adversaries against any exposed WordPress site running the vulnerable software versions."
}