CVE-2022-0830: Formbuilder Project Formbuilder

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as escape its form field values. As a result, attackers could make logged in admin update and delete arbitrary forms via a CSRF attack, and put Cross-Site Scripting payloads in them.

Affected products

• Formbuilder Project Formbuilder: up to and including 1.08

Published 2022-04-04. Last modified 2026-06-17.