Easy Form Builder By Whitestudio
Monthly
Stored cross-site scripting (XSS) in the Easy Form Builder by WhiteStudio WordPress plugin (versions 4.0.0 up to but not including 4.2.0) lets unauthenticated attackers submit crafted values to certain form types that are stored and later rendered without escaping in an administrator-facing submissions page. Publicly available exploit code exists, and the vendor has released version 4.2.0 to fix the flaw. Our independent assessment rates this as a scope-changed XSS with low confidentiality and integrity impact, lower than the vendor’s 8.8 CVSS score, because the payload only executes when a privileged user views the plugin’s admin page.
Unauthenticated attackers can create WordPress user accounts on sites running the Easy Form Builder by WhiteStudio plugin in versions 4.0.0 through before 4.2.0, even when the site owner has deliberately disabled user registration. The plugin fails to validate a submitted value against its stored configuration for certain form types (CWE-284, improper access control), so the registration-disabled setting is bypassed via a remote, unauthenticated request requiring no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3). Publicly available exploit code exists for this issue, but it is not confirmed as actively exploited (not in CISA KEV); the realistic impact is bounded by the site's default new-user role, typically Subscriber, and updating to 4.2.0 fully removes the flaw.
Stored cross-site scripting (XSS) in the Easy Form Builder by WhiteStudio WordPress plugin (versions 4.0.0 up to but not including 4.2.0) lets unauthenticated attackers submit crafted values to certain form types that are stored and later rendered without escaping in an administrator-facing submissions page. Publicly available exploit code exists, and the vendor has released version 4.2.0 to fix the flaw. Our independent assessment rates this as a scope-changed XSS with low confidentiality and integrity impact, lower than the vendor’s 8.8 CVSS score, because the payload only executes when a privileged user views the plugin’s admin page.
Unauthenticated attackers can create WordPress user accounts on sites running the Easy Form Builder by WhiteStudio plugin in versions 4.0.0 through before 4.2.0, even when the site owner has deliberately disabled user registration. The plugin fails to validate a submitted value against its stored configuration for certain form types (CWE-284, improper access control), so the registration-disabled setting is bypassed via a remote, unauthenticated request requiring no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, 5.3). Publicly available exploit code exists for this issue, but it is not confirmed as actively exploited (not in CISA KEV); the realistic impact is bounded by the site's default new-user role, typically Subscriber, and updating to 4.2.0 fully removes the flaw.