CVE-2026-119183
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a form field mapped to a post meta key (e.g., lst_cost) in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. Exploitation requires a public Insert Post form writing to a post meta key and a Calculated Field whose formula references that key via the %META::key% macro.
Risk Assessment
Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page, potentially leading to data theft or account compromise.
Recommendation
Update the JetFormBuilder plugin to a version later than 3.6.8. Until then, consider disabling public Insert Post forms or removing %META::key% macros from Calculated Field formulas.
Other vulnerabilities in JetFormBuilder
See all- CVE-2026-123482High
The Crocoblock JetFormBuilder plugin contains a Cross-site Scripting vulnerability (improper neutralization of input during web page generation). The Stored XSS issue affects versions through 3.6.8.
- CVE-2026-123484High
The WordPress JetFormBuilder plugin up to version 3.6.8 contains a DOM-Based XSS vulnerability caused by improper neutralization of input during web page generation. Malicious code is executed client-side within the browser DOM.
- CVE-2026-107431High
A Missing Authorization vulnerability in Crocoblock JetFormBuilder allows exploiting incorrectly configured access control security levels. Affects versions up to 3.6.6.
- CVE-2026-119481Critical
The JetFormBuilder plugin (through version 3.6.7.1) contains an incorrect privilege assignment vulnerability enabling privilege escalation. A low-privileged user can perform actions reserved for higher roles.
- CVE-2026-123860Medium
The JetFormBuilder plugin by Crocoblock up to and including 3.6.8 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags, allowing code injection.
- CVE-2026-123483Medium
The JetFormBuilder plugin by Crocoblock up to and including 3.6.8 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags, allowing code injection.
- CVE-2026-121977Medium
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to stored cross-site scripting via the 'note' parameter (a form field written to post meta) in versions up to and including 3.6.8 due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts that execute when a user accesses an injected page. Successful exploitation requires a privileged user with the edit_others_posts capability to visit a form URL containing the attacker-created post ID.
- CVE-2026-119480Medium
The JetFormBuilder plugin (Crocoblock) contains a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. The issue affects versions up to and including 3.6.7.1.
- CVE-2026-119479Medium
The JetFormBuilder plugin (Crocoblock) through 3.6.7.1 contains a Basic XSS vulnerability due to improper neutralization of script-related HTML tags. This can lead to code injection in the page context.
- CVE-2026-119482Medium
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetFormBuilder: from n/a through 3.6.7.1.
Original NVD description (English source)
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<form field mapped to a post meta key, e.g. lst_cost>' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to have configured a public Insert Post form writing to a post meta key and a Calculated Field whose formula references that key via the %META::key% macro, after which a single unauthenticated POST is sufficient to persist the payload.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS