The MW WP Form plugin for WordPress contains a stored cross‑site scripting vulnerability in the 'memo' field for all versions up to and including 5.1.3. The memo value is persisted with the WordPress function update_post_meta, which bypasses WordPress’s built‑in KSES sanitization and unfiltered_html protections. As a result, an authenticated attacker with editor‑level or higher access can inject arbitrary JavaScript that is stored as part of the memo and will execute whenever any user views the page containing that memo. This flaw is the result of insufficient input sanitization and output escaping as specified in the description.

The vulnerability affects installations of the MW WP Form plugin by websoudan, specifically all versions 5.1.3 and earlier. Sites that have deployed these versions and granted editor‑level or higher permissions to users are susceptible.

The CVSS score of 4.4 indicates moderate severity. EPSS data are not available, so the current likelihood of exploitation is unknown. The issue is not listed in the CISA KEV catalog. Because the flaw requires authenticated editor privileges, it cannot be exploited by an unauthenticated attacker, yet once the memo is compromised all users who access the affected page will run the injected script. The impact is confined to the site’s audience and depends on the quantity of users who view the memo field.