The Easy Form Builder plugin for WordPress is affected by an unauthenticated Cross Site Scripting flaw in all releases up to and including version 4.0.12. The vulnerability allows an attacker to inject unseen JavaScript code that is later rendered in the form interface presented to site visitors, potentially enabling tampering with page content, theft of stored browser data, or other malicious client‑side activity.

WordPress websites that have installed the Easy Form Builder plugin from vendor hassantafreshi with a version of 4.0.12 or older are vulnerable. The issue does not affect newer plugin releases.

The CVSS score of 7.1 places this flaw in the high‑severity range. The EPSS score of less than 1% suggests a low probability of exploitation in the wild at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation does not require authentication; any user who interacts with the affected form can supply data that will be rendered in the victim’s browser, allowing the injection of arbitrary JavaScript.