Is CVE-2026-85122 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85122 being exploited in the wild.

How severe is CVE-2026-85122?

High severity, with a CVSS score of 8.8, published 18 September 2026.

Which products and versions are affected?

WhiteStudio Easy Form Builder 4.0.0 to 4.1.3.

Is there a fix for CVE-2026-85122?

A patch was published on 2026-09-16: Fixed in version 4.2.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85122 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-85122?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85122: WhiteStudio Easy Form Builder stored XSS in admin page

CVE-2026-85122 · Severity: high · CVSS 8.8 · Published 2026-09-18

The Easy Form Builder WordPress plugin contains an unauthenticated stored cross-site scripting (XSS) vulnerability that allows attackers to submit malicious code through form fields without validation. When administrators view certain form submissions, the attacker's code executes in their browser, potentially compromising site security or allowing account takeover.

Quick answers

Is CVE-2026-85122 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85122 being exploited in the wild.
How severe is CVE-2026-85122?: High severity, with a CVSS score of 8.8, published 18 September 2026.
Which products and versions are affected?: WhiteStudio Easy Form Builder 4.0.0 to 4.1.3.
Is there a fix for CVE-2026-85122?: A patch was published on 2026-09-16: Fixed in version 4.2.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85122 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-85122?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a stored XSS issue (CWE-79) caused by insufficient input validation on form submissions. The plugin fails to validate submitted form values against their stored configuration for some form types, allowing unauthenticated users to store arbitrary content. This content is later rendered unescaped in the WordPress admin pages, leading to arbitrary JavaScript execution in administrator browser contexts. The vulnerability affects versions 4.0.0 through 4.1.3 and is fixed in version 4.2.0. No special authentication or preconditions are required for exploitation—any unauthenticated user can submit the malicious payload via a form.

Affected products

WhiteStudio Easy Form Builder 4.0.0 to 4.1.3

Timeline

2026-09-16: disclosed: Publicly disclosed
2026-09-16: patched: Fixed in version 4.2.0
2026-09-18: advisory: CVE-2026-85122 published

References

https://wpscan.com/vulnerability/7263f875-3ff3-410a-94b0-fa4b3694d356/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.