The MW WP Form plugin contains a stored cross‑site scripting flaw that originates from the unfiltered 'post_id' request parameter. Because input sanitization and output escaping are missing, an unauthenticated user can store malicious scripts in form‑related post meta that will then run for any visitor who loads the affected page. This allows a remote attacker to run arbitrary client‑side code, compromising confidentiality, integrity, or availability of the site and potentially misleading users or spreading malware.

The vulnerability exists in all versions of MW WP Form up to and including 5.1.7. The affected product is distributed by the vendor websoudan. No specific operating‑system or WordPress version constraints are listed, so any site running an affected release is at risk.

The CVSS score of 7.2 indicates a high severity. The report shows no EPSS value, meaning the likelihood of exploitation at the time of analysis is not quantifiable, and the entry is not listed in CISA’s KEV catalog. Attackers can exploit the flaw without authentication by first viewing the public form page to acquire a double‑submit cookie that bypasses the CSRF gate, after which they can submit a malicious payload that will be stored and executed on subsequent page accesses. The ability to inject client‑side script remotely and the lack of an effective protection mechanism result in a significant risk for compromised user experience and potential data theft.