EUVD-2026-36700
GHSA-x9r5-r92q-89hf
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L reflects required Editor-level authentication; S:C and C:L/I:L capture cross-browser script execution impact; UI:R required as victim must load the affected form page.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Form Builder CP WordPress plugin before 1.2.47 does not properly sanitize a form configuration value before storing it and using it as part of a client-side script execution, allowing authenticated users with Editor-level access and above to perform Stored Cross-Site Scripting attacks against any visitor of a page rendering the affected form, even when the unfiltered_html capability is disallowed (e.g. in a multisite network).
AnalysisAI
Stored Cross-Site Scripting in the Form Builder CP WordPress plugin (all versions before 1.2.47) allows authenticated users holding Editor-level access or above to inject persistent malicious scripts via unsanitized form configuration values, which execute in every visitor's browser upon rendering the affected form. Critically, this attack succeeds even when WordPress's unfiltered_html capability has been revoked - a control that multisite administrators commonly rely on to prevent exactly this class of injection from Editor-level roles. A publicly available exploit exists per WPScan, though no confirmed active exploitation (CISA KEV) has been recorded and the EPSS score of 0.19% (9th percentile) reflects limited automated mass exploitation at time of analysis.
Technical ContextAI
The affected component is the Form Builder CP WordPress plugin (CPE: cpe:2.3:a:unknown:form_builder_cp:*:*:*:*:*:*:*:*), a plugin that renders configurable HTML forms on WordPress pages. The root cause is a failure to apply output encoding or input sanitization to at least one form configuration field before that value is stored in the WordPress database and later emitted into client-side script execution context. This is a Stored (Persistent) XSS pattern - the payload persists server-side and fires for every affected page visitor, not just once. While CWE is not formally assigned in the NVD record, the vulnerability aligns with CWE-79 (Improper Neutralization of Input During Web Page Generation). The particularly notable technical detail is the bypass of WordPress's unfiltered_html capability gate: WordPress multisite networks routinely revoke this capability from Editor roles to prevent them from injecting raw HTML or scripts, but the plugin fails to enforce equivalent restrictions on its own configuration surface, creating a privilege escalation path from restricted Editor to effective script-injector.
RemediationAI
Update the Form Builder CP WordPress plugin to version 1.2.47 or later, which contains the vendor-released patch addressing the unsanitized form configuration value. The update can be applied through the standard WordPress plugin update interface or by downloading the patched release directly from the WordPress plugin repository. The WPScan advisory at https://wpscan.com/vulnerability/b306b6f1-ca34-495f-a823-6e8f66e343d7/ provides disclosure details confirming the fix version. If immediate patching is not operationally feasible, restrict Editor-level role assignments to only fully trusted internal users and audit existing Editor accounts for unauthorized additions - this reduces the pool of potential attackers but does not eliminate the vulnerability. Temporarily disabling the Form Builder CP plugin on affected sites is an effective compensating control with the trade-off of losing form functionality. Critically, do not rely on the WordPress unfiltered_html capability restriction as a mitigation - this CVE documents a specific bypass of that control.
More in Form Builder Cp
View allThe Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could a
The Form Builder CP plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'CP_EASY_FORM_WILL
Share
External POC / Exploit Code
Leaving vuln.today