What is the CVSS score of CVE-2026-59517?

CVE-2026-59517 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Easy Form Builder are affected by CVE-2026-59517?

Easy Form Builder WordPress plugin versions 4.0.12 and earlier expose all sites using this plugin to unauthenticated Cross-Site Scripting attacks that can compromise user sessions and administrator…

How to fix or mitigate CVE-2026-59517?

Within 24 hours, identify all WordPress instances running Easy Form Builder versions 4.0.12 or earlier and document their criticality and data sensitivity. Within 7 days, deploy Web Application Firewall rules to block XSS payloads in form submission inputs, apply restrictive Content Security Policy headers, and configure input sanitization on form processors. Within 30 days, establish monitoring for vendor patches to version 4.0.13 or later; evaluate and test alternative form builder plugins as replacement candidates; disable the plugin on low-priority sites if not actively used.

Easy Form Builder CVE-2026-59517

EUVD-2026-48188 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-23 Patchstack

GHSA-cv27-8gjp-p87j

WordPress XSS Wordpress Plugin Easy Form Builder

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated (PR:N) network XSS requiring a victim to load the payload (UI:R), with scope change (S:C) into the browser session and limited C/I/A impact typical of reflected/stored XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:25 vuln.today

CVE Published

Jul 23, 2026 - 11:18 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.

AnalysisAI

Stored/reflected Cross-Site Scripting in the Easy Form Builder WordPress plugin (versions 4.0.12 and earlier) allows remote unauthenticated attackers to inject malicious scripts that execute in a victim's browser when they view an affected page. Because PR:N and no authentication is required, an attacker only needs to lure a user (UI:R) into triggering the payload, and the scope-changed vector (S:C) means the injected script can affect the broader WordPress session context. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Easy Form Builder (vendor 'hassantafreshi', CPE cpe:2.3:a:hassantafreshi:easy_form_builder) is a WordPress plugin used to construct and render web forms. The flaw is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-supplied input is reflected or stored and later emitted into HTML output without adequate encoding or sanitization. In WordPress form plugins this class of bug typically arises from unescaped form field values, parameters, or submission handlers rendered back into the page or admin dashboard, allowing arbitrary HTML/JavaScript to run in the browser of anyone who loads the affected content.

RemediationAI

No fixed version is stated in the provided data, so no vendor-released patch version is independently confirmed at time of analysis; administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/easy-form-builder/vulnerability/wordpress-easy-form-builder-plugin-4-0-12-cross-site-scripting-xss-vulnerability) and upgrade to any release later than 4.0.12 once available. As compensating controls until a patch is applied, deactivate and remove the Easy Form Builder plugin (side effect: any forms it renders will stop working), or place a Web Application Firewall / virtual patch in front of the site to filter XSS payloads on the plugin's form-handling endpoints (side effect: possible false positives on legitimate form input). Restricting or monitoring the pages where the plugin's forms are exposed reduces the window in which a victim can be lured into triggering the payload.