Easy Form Builder vulnerabilities

The Easy Form Builder plugin version 4.0.12 and earlier contains a Cross Site Scripting (XSS) vulnerability without requiring authentication. An attacker can inject malicious JavaScript code into the page.

CVE-2026-42747 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in Easy Form Builder. This issue affects versions from n/a through 4.0.6.

The Easy Form Builder plugin (by hassantafreshi) contains a Missing Authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects Easy Form Builder from n/a through <= 3.8.20.