CVE-2026-97342

HighCVSS 7.2

Published: 02/10/2026(UTC)Updated: 03/10/2026(UTC)Translated: 02/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

Risk Assessment

An unauthenticated attacker can inject malicious scripts that execute in the browser of users visiting affected pages, potentially leading to data theft or session hijacking.

Recommendation

Update the JetFormBuilder plugin to the latest patched version and restrict access to public form endpoints if possible.

Other vulnerabilities in JetFormBuilder — Dynamic Blocks Form Builder

CVE-2026-12793Critical
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress in all versions up to and including 3.6.2 is vulnerable to Privilege Escalation. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This allows unauthenticated attackers to create a new administrator-level user account.

Original NVD description (English source)

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS