PT-2026-49186 · WordPress · Form Builder

Luca Jungnickel · Published 2026-06-15 · Updated 2026-06-15 · CVE-2026-9278

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Form Builder CP WordPress plugin versions prior to 1.2.47

Description Insufficient sanitization of a form configuration value before storage and subsequent use in client-side script execution allows authenticated users with Editor-level access or higher to perform Stored Cross-Site Scripting (XSS). This occurs even when the unfiltered html capability is disabled, such as in multisite networks, affecting any visitor who views a page rendering the compromised form.

Recommendations Update the plugin to version 1.2.47 or later.

Exploit

Related Identifiers

CVE-2026-9278

Affected Products

Form Builder

References · 3

• 🔥 https://wpscan.com/vulnerability/b306b6f1-ca34-495f-a823-6e8f66e343d7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9278 · Security Note
• https://twitter.com/VulmonFeeds/status/2066446841156141149 · Twitter Post