CVE-2026-59517

HighCVSS 7.1

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Summary

The Easy Form Builder plugin version 4.0.12 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.

Risk Assessment

The organization is at risk of user session theft, redirects to malicious sites, and theft of data entered in forms.

Recommendation

Update the Easy Form Builder plugin to a version above 4.0.12 that eliminates the XSS vulnerability.

Other vulnerabilities in Easy Form Builder

CVE-2026-42747Critical
CVE-2026-42747 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in Easy Form Builder. This issue affects versions from n/a through 4.0.6.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Easy Form Builder <= 4.0.12 versions.