CVE-2026-92212
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The JetFormBuilder plugin for WordPress (versions up to and including 3.6.5.3) is vulnerable to Reflected Cross-Site Scripting via the 'jfb_xss' URL Query Variable Parameter. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject malicious scripts that execute if they can trick a user into clicking a link.
Risk Assessment
An unauthenticated attacker can trick a user into clicking a malicious link, potentially leading to session theft, account takeover, or modification of content visible to the user.
Recommendation
Update the JetFormBuilder plugin to a version newer than 3.6.5.3 as soon as a fix is available, and in the meantime consider disabling the calculated field feature.
Other vulnerabilities in JetFormBuilder WordPress Plugin
See all- CVE-2026-120561Medium
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress in versions up to and including 3.6.2 allows unauthorized data modification due to a missing capability check on the 'do_action' function in the 'Update_Options' action class. Unauthenticated attackers can modify JetEngine Options Page values when an administrator has configured a form with the "Update Options" post-submission action. The vulnerability requires both JetFormBuilder and JetEngine to be installed and active and a form configured with the Update Options action.
- CVE-2026-19862Medium
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients and spoof the sender. Exploitation requires the site to be configured to take one of the message's addresses from a form field.
Original NVD description (English source)
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to host a form configured with both a URL Query Variable preset field and a Calculated Field that references it, which are standard plugin features.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS