CVE-2026-6293

OVERVIEW CVE-2026-6293 affects the Inquiry Form to Posts or Pages plugin for WordPress version 1.0. The vulnerability stems from two critical security flaws: missing Cross-Site Request Forgery (CSRF) protection on the plugin settings update handler and insufficient input sanitization combined with absent output escaping. An unauthenticated attacker can exploit this vulnerability to inject arbitrary web scripts into the plugin settings, which are then stored and executed in the browsers of administrators and other users who view the affected pages. SEVERITY This vulnerability carries a CVSS 3.1 score of 4.3 (MEDIUM) with a network-based attack vector requiring low complexity and user interaction. The attack requires an administrator to visit a malicious webpage, but does not require prior authentication from the attacker. While the confidentiality and availability impacts are none, the integrity impact is rated as low, reflecting the ability to inject malicious scripts into stored plugin settings. EXPLOITATION STATUS CVE-2026-6293 is not currently being actively exploited in the wild. The vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. The EPSS score of 0.00009 indicates minimal probability of exploitation within the next 30 days, and community attention remains low relative to other disclosed vulnerabilities.