CVE-2026-85122

Overview

The Easy Form Builder plugin for WordPress, prior to version 4.2.0, fails to validate submitted values against stored configurations for specific form types. This allows unauthenticated attackers to store arbitrary content that is subsequently rendered unescaped within an administrative dashboard. Consequently, it creates a Stored Cross-Site Scripting (XSS) vulnerability that impacts administrative users.

Description

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS.

Impact

This vulnerability impacts the integrity and confidentiality of the WordPress administration interface by allowing stored cross-site scripting attacks. An unauthenticated attacker can inject arbitrary content, which executes in the context of an administrator's browser session when they view the submissions page. This could lead to unauthorized actions performed within the admin panel or session hijacking.

Remediation

Update the Easy Form Builder plugin to version 4.2.0 or later where input validation issues are addressed. As a defense-in-depth measure, restrict administrative access to trusted IP addresses and monitor plugin change logs for unauthorized modifications.

Risk context

The vulnerability carries a CVSS v3 score of 6.1, placing it in the medium severity range. Although exploitation requires no authentication, it relies on an administrator interacting with the malicious payload within the dashboard, moderating the overall operational risk.

Affected products

• WhiteStudio Easy Form Builder < 4.2.0