CVE-2026-85122NVD

Description

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS.

Severity Level

UNKNOWN

Published Date

18/09/2026

Last Modified

18/09/2026

Exploitation Status

????

EPSS Score

0.34% (percentile 27.6%)

Affected & Patched Versions

Product	Affected Versions	Patched Version
Unknown Easy Form Builder by WhiteStudio	4.0.0 - < 4.2.0	N/A

📧Email Delivery — Threat intel straight to your inbox.

♾️Unlimited Vendors — Track your entire stack.

🚨All New CVEs — Be the first to know.

⚙️Custom EPSS — Filter noise, focus on risk.

💬Webhooks — Slack & Teams integration.

🚫Ad-Free — Uninterrupted experience.