WordPress plugin
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 12 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High4
- Medium6
- Low0
All Easy Form Builder by WhiteStudio – Drag & Drop Form Builder vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.2 | 4.1.3 - Unauthenticated Stored Cross-Site Scripting 4.0.0 – 4.1.3Update to 4.2.0 | CVE-2026-85122 | |
| Medium5.3 | 4.1.3 - Missing Authorization 4.0.0 – 4.1.3Update to 4.2.0 | CVE-2026-85123 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤4.0.12Update to 4.0.13 | CVE-2026-59517 | |
| Critical9.8 | Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint ≤4.0.11Update to 4.0.12 | CVE-2026-13439 | |
| High7.5 | Unauthenticated SQL Injection ≤4.0.6Update to 4.0.7 | CVE-2026-42747 | |
| Medium5.3 | Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure ≤3.9.3Update to 3.9.4 | CVE-2025-14067 | |
| Medium4.3 | Missing Authorization ≤3.9.6Update to 4.0.0 | CVE-2026-22472 | |
| Medium5.3 | Missing Authorization ≤3.8.20Update to 3.8.21 | CVE-2025-67577 | |
| High7.5 | Unauthenticated SQL Injection ≤3.8.15Update to 3.8.16 | CVE-2025-54678 | |
| Medium6.4 | Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting ≤3.8.8Update to 3.8.9 | CVE-2024-12112 | |
| Critical9.9 | Authenticated (Contributor+) SQL Injection ≤3.7.4Update to 3.7.5 | CVE-2024-30535 | |
| Medium5.5 | Authenticated (Administrator+) Stored Cross-Site Scripting ≤3.3.8Update to 3.4.0 | CVE-2022-3906 |
- High7.24.1.3 - Unauthenticated Stored Cross-Site Scripting
4.0.0 – 4.1.3Update to 4.2.0
- Medium5.34.1.3 - Missing Authorization
4.0.0 – 4.1.3Update to 4.2.0
- High7.2Unauthenticated Stored Cross-Site Scripting
≤4.0.12Update to 4.0.13
- Critical9.8Unauthenticated Privilege Escalation to Administrator via Password Recovery REST Endpoint
≤4.0.11Update to 4.0.12
- High7.5Unauthenticated SQL Injection
≤4.0.6Update to 4.0.7
- Medium5.3Missing Authorization to Authenticated (Subscriber+) Sensitive Form Response Data Exposure
≤3.9.3Update to 3.9.4
- Medium4.3Missing Authorization
≤3.9.6Update to 4.0.0
- Medium5.3Missing Authorization
≤3.8.20Update to 3.8.21
- High7.5Unauthenticated SQL Injection
≤3.8.15Update to 3.8.16
- Medium6.4Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
≤3.8.8Update to 3.8.9
- Critical9.9Authenticated (Contributor+) SQL Injection
≤3.7.4Update to 3.7.5
- Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
≤3.3.8Update to 3.4.0
Easy Form Builder by WhiteStudio – Drag & Drop Form Builder: common questions
Does Easy Form Builder by WhiteStudio – Drag & Drop Form Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 12 known vulnerabilities in Easy Form Builder by WhiteStudio – Drag & Drop Form Builder: 2 critical, 4 high, 6 medium. None are known to affect version null.
How do I check which version of Easy Form Builder by WhiteStudio – Drag & Drop Form Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Easy Form Builder by WhiteStudio – Drag & Drop Form Builder vulnerability?
CVE-2026-85122, published Sep 16, 2026: Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any Easy Form Builder by WhiteStudio – Drag & Drop Form Builder vulnerability listed in CISA KEV?
No. None of the known Easy Form Builder by WhiteStudio – Drag & Drop Form Builder vulnerabilities is currently listed in the CISA KEV catalog.