What’s Vulnerable › Vulnerabilities
CVE-2026-85122: Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-18 · updated 2026-09-18
- Weakness: CWE-79
Description
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS.
Affected products
- Easy Form Builder by WhiteStudio: from 4.0.0 before 4.2.0 — fixed in 4.2.0
How to fix
Upgrade to a fixed version: Easy Form Builder by WhiteStudio 4.2.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-85122 or the next vulnerability affects your stack