Form Builder CP CVE-2026-9278

Exploitation requires an authenticated WordPress user account with Editor-level access or higher - unauthenticated exploitation is not possible (CVSS PR:L). The Form Builder CP plugin must be installed, active, and at a version below 1.2.47. At least one form created by the plugin must be embedded on a publicly or internally accessible page. Victim interaction is required: a target user must load a page rendering the affected form (CVSS UI:R). The attack is specifically effective in WordPress multisite environments where administrators have disabled the unfiltered_html capability for Editor roles, believing this prevents script injection - this plugin's sanitization failure bypasses that control entirely. Exploitation is bounded by: (1) need for valid Editor credentials, (2) victim must navigate to an affected page, and (3) the form must be actively deployed on a rendered page.

The CVSS 5.4 Medium score is appropriate in isolation but understates the deployment risk for WordPress multisite environments. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) captures the scope change (S:C) correctly - injected scripts execute in victim browsers, enabling session hijacking, credential phishing, or further lateral movement against site users or admins. The PR:L rating reflects the Editor-level authentication barrier, which meaningfully limits attack surface compared to unauthenticated XSS. However, the unfiltered_html bypass means organizations that explicitly locked down Editor roles under the assumption that this prevented script injection are exposed in a way inconsistent with their assumed security posture - effectively elevating real-world impact beyond what the CVSS score alone suggests. EPSS at 0.19% (9th percentile) indicates low probability of opportunistic mass exploitation, consistent with the authenticated prerequisite. A publicly available exploit exists (sourced from WPScan), which lowers attacker skill requirements. No CISA KEV listing means active exploitation is not confirmed - EPSS and KEV signals are consistent with targeted rather than widespread exploitation. CVSS vector and description are fully consistent - no conflicting signals detected.

A publicly available exploit exists for this vulnerability. An attacker who has obtained or been granted Editor-level WordPress credentials navigates to the Form Builder CP plugin configuration and injects a JavaScript payload (e.g., a cookie-stealing script) into an unsanitized form configuration field. The payload is stored in the database and silently executes in the browser of every subsequent visitor who loads any page on the site where the affected form is embedded, enabling session token theft or admin account takeover without further attacker interaction.