Executive brief
The Easy Form Builder WordPress plugin contains an unauthenticated stored cross-site scripting (XSS) vulnerability that allows attackers to submit malicious code through form fields without validation. When administrators view certain form submissions, the attacker's code executes in their browser, potentially compromising site security or allowing account takeover.
Technical details
The vulnerability is a stored XSS issue (CWE-79) caused by insufficient input validation on form submissions. The plugin fails to validate submitted form values against their stored configuration for some form types, allowing unauthenticated users to store arbitrary content. This content is later rendered unescaped in the WordPress admin pages, leading to arbitrary JavaScript execution in administrator browser contexts. The vulnerability affects versions 4.0.0 through 4.1.3 and is fixed in version 4.2.0. No special authentication or preconditions are required for exploitation—any unauthenticated user can submit the malicious payload via a form.
Affected products
- WhiteStudio Easy Form Builder 4.0.0 to 4.1.3
Timeline
- 2026-09-16: disclosed: Publicly disclosed
- 2026-09-16: patched: Fixed in version 4.2.0
- 2026-09-18: advisory: CVE-2026-85122 published