Quill Forms | Conversational Multi Step Forms, Surveys & Quizzes (<= 5.7.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/quill-forms--conversational-multi-step-forms-surveys--quizzes--5.7.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 19 Sep 2026 10:11:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStored XSS in Quill Forms WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-09-quill-forms-xss/Sat, 19 Sep 2026 10:11:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-quill-forms-xss/The Quill Forms WordPress plugin (<= 5.7.1) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript via form entry fields.The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress (versions 5.7.1 and below) contains a stored cross-site scripting (XSS) vulnerability. The issue arises from insufficient sanitization and escaping of the 'Other' value field within Multiple Choice form elements. This allows an unauthenticated remote attacker to submit malicious payloads through publicly accessible forms. When a WordPress administrator accesses the form results page within the dashboard, the payload is rendered and executes in the context of their active session. This can lead to unauthorized actions performed on behalf of the administrator, such as creating new administrative accounts, modifying site settings, or exfiltrating sensitive session tokens.

Impact

The vulnerability targets administrative accounts reviewing form submissions. Successful exploitation grants attackers the ability to execute arbitrary JavaScript within the WordPress admin dashboard, potentially leading to full site takeover.

Recommendation

Update the Quill Forms plugin to the latest patched version immediately. Monitor web server logs for HTTP POST requests to form submission endpoints containing JavaScript keywords or HTML tags within the 'Other' input parameters.

]]>highadvisorywordpressxssweb-application