WordPress Form Builder Plugin Stores Unvalidated User Input as XSS

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Easy Form Builder plugin for WordPress fails to validate user-submitted form data against its stored configuration before rendering it on admin pages, creating a Stored XSS vulnerability. Unauthenticated attackers can inject malicious scripts that persist in the application and execute whenever administrators view affected pages. This impacts any WordPress site using the plugin before version 4.2.0, potentially compromising admin accounts and enabling further site takeover. The CVSS score of 8.8 reflects the severity—combining network accessibility, low attack complexity, and high impact on confidentiality and integrity.

Casky's 323 mapped skills across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance) enable practitioners to detect this attack pattern through multiple angles. When analyzing this CVE, practitioners would surface findings related to CWE-79 input validation failures, identifying the absence of output encoding during admin page rendering—a classic XSS signature. Claude's extended reasoning helps practitioners understand the attack chain: how unauthenticated reconnaissance of form endpoints (TA0043) leads to discovery of validation gaps, followed by payload injection that executes in the admin context. Practitioners can map detection opportunities to form submission logging, admin page rendering analysis, and DOM-based XSS pattern recognition, enabling both preventive patching and detection of active exploitation attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-85122.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-85122

Casky has 323 skills that investigate the attack patterns behind CVE-2026-85122. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn