CVE-2026-85122 Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion
Unauthenticated attackers can inject malicious scripts via form type confusion, leading to stored XSS in admin pages of Easy Form Builder.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-85122?
CVE-2026-85122 is a high-severity cross-site scripting vulnerability in Unknown Easy Form Builder by WhiteStudio, published on 18 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS.
Weakness: CWE-79
Which versions are affected by CVE-2026-85122?
How do I fix CVE-2026-85122?
No fix has been published for CVE-2026-85122 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-85122 being exploited?
There is no known exploitation of CVE-2026-85122 in the wild and no public exploit code.
Sources
Also known as GHSA-8g63-4vhx-3q8r.