CVE-2026-19862
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.
Risk Assessment
An attacker could send emails with a spoofed sender or hidden recipients, potentially leading to phishing or reputational damage.
Recommendation
Update the JetFormBuilder plugin to version 3.6.5.2 or later and configure input validation.
Other vulnerabilities in JetFormBuilder WordPress plugin
See all- CVE-2026-120561Medium
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress in versions up to and including 3.6.2 allows unauthorized data modification due to a missing capability check on the 'do_action' function in the 'Update_Options' action class. Unauthenticated attackers can modify JetEngine Options Page values when an administrator has configured a form with the "Update Options" post-submission action. The vulnerability requires both JetFormBuilder and JetEngine to be installed and active and a form configured with the Update Options action.
- CVE-2026-92212Medium
The JetFormBuilder plugin for WordPress (versions up to and including 3.6.5.3) is vulnerable to Reflected Cross-Site Scripting via the 'jfb_xss' URL Query Variable Parameter. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject malicious scripts that execute if they can trick a user into clicking a link.
Original NVD description (English source)
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS