CVE-2026-59517
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Easy Form Builder plugin version 4.0.12 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.
Risk Assessment
The organization is at risk of user session theft, redirects to malicious sites, and theft of data entered in forms.
Recommendation
Update the Easy Form Builder plugin to a version above 4.0.12 that eliminates the XSS vulnerability.
Other vulnerabilities in Easy Form Builder
See all- CVE-2026-42747Critical
CVE-2026-42747 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in Easy Form Builder. This issue affects versions from n/a through 4.0.6.
- CVE-2025-67577Medium
The Easy Form Builder plugin (by hassantafreshi) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Easy Form Builder from n/a through <= 3.8.20.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS