The Easy Form Builder WordPress plugin (versions up to 3.8.8) suffers from a stored cross-site scripting vulnerability due to improper neutralization of input in the 'name' parameter of the 'add_form_Emsfb' AJAX action. Authenticated users with low privileges (Subscriber and above) can inject arbitrary JavaScript that executes in the context of other users viewing the injected content. This occurs because of insufficient input sanitization, lack of output escaping, and missing authorization checks in the plugin's code handling form submissions.

Successful exploitation allows an authenticated attacker with Subscriber-level access or higher to inject persistent malicious scripts into pages generated by the plugin. This can lead to unauthorized actions performed in the context of other users, potential theft of session tokens, or other client-side impacts. The vulnerability does not affect availability and has limited impact on confidentiality and integrity as per the CVSS vector (C:L/I:L/A:N). No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and consider disabling or removing the plugin if possible. Monitor for updates from the vendor or plugin repository to apply any forthcoming patches promptly.