CVE-2026-19861
Received Received - Intake

Cross-Site Scripting in JetFormBuilder WordPress Plugin

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: WPScan

Description
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. Whether injected script executes depends on the recipient's mail client, but the injected markup is rendered regardless.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-19861
EUVD
EUVD-2026-71847

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jetformbuilder jetformbuilder to 3.6.5.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an unauthenticated stored cross-site scripting (XSS) vulnerability in the JetFormBuilder WordPress plugin. It allows attackers to inject arbitrary HTML or scripts into form field values, which are then included in HTML notification emails sent to administrators and other recipients without proper sanitization or escaping.

Detection Guidance

This vulnerability is specific to the JetFormBuilder WordPress plugin. To detect it, check the installed version of the plugin. If it is below 3.6.5.2, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the version.

Impact Analysis

Attackers could exploit this to send malicious emails containing harmful scripts or HTML to users. While script execution depends on the recipient's mail client, the injected content will still be visible in the email, potentially leading to phishing attacks, data theft, or unauthorized actions if the email content is rendered.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure if exploited, potentially violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations may face compliance penalties if user data is compromised through such attacks.

Mitigation Strategies

Immediately update the JetFormBuilder plugin to version 3.6.5.2 or later. This can be done via the WordPress admin panel under 'Plugins' or by manually replacing the plugin files with the updated version. Ensure backups are taken before updating.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19861. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart