Stored Cross-Site Scripting Vulnerability in Form Builder CP Plugin for WordPress
CVE-2026-9278
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 15 June 2026
Badges
What is CVE-2026-9278?
The Form Builder CP plugin for WordPress, prior to version 1.2.47, is susceptible to stored cross-site scripting (XSS) attacks due to inadequate sanitization of form configuration values. This vulnerability allows authenticated users with Editor-level access or higher to inject malicious scripts into the form, which are then executed in the browser of any visitor viewing the affected pages. Notably, this risk persists even in environments where the unfiltered_html capability is restricted, such as multisite networks, thereby enhancing the potential for exploitation.
Affected Version(s)
Form Builder CP 0 < 1.2.47
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.