EUVD-2026-36700
GHSA-x9r5-r92q-89hf
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
PR:L reflects required Editor-level authentication; S:C and C:L/I:L capture cross-browser script execution impact; UI:R required as victim must load the affected form page.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Form Builder CP WordPress plugin before 1.2.47 does not properly sanitize a form configuration value before storing it and using it as part of a client-side script execution, allowing authenticated users with Editor-level access and above to perform Stored Cross-Site Scripting attacks against any visitor of a page rendering the affected form, even when the unfiltered_html capability is disallowed (e.g. in a multisite network).
AnalysisAI
Stored Cross-Site Scripting in the Form Builder CP WordPress plugin (all versions before 1.2.47) allows authenticated users holding Editor-level access or above to inject persistent malicious scripts via unsanitized form configuration values, which execute in every visitor's browser upon rendering the affected form. Critically, this attack succeeds even when WordPress's unfiltered_html capability has been revoked - a control that multisite administrators commonly rely on to prevent exactly this class of injection from Editor-level roles. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress user account with Editor-level access or higher - unauthenticated exploitation is not possible (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium score is appropriate in isolation but understates the deployment risk for WordPress multisite environments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A publicly available exploit exists for this vulnerability. An attacker who has obtained or been granted Editor-level WordPress credentials navigates to the Form Builder CP plugin configuration and injects a JavaScript payload (e.g., a cookie-stealing script) into an unsanitized form configuration field. … |
| Remediation | Update the Form Builder CP WordPress plugin to version 1.2.47 or later, which contains the vendor-released patch addressing the unsanitized form configuration value. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today