CVE-2026-92212
Received Received - Intake

Reflected Cross-Site Scripting in JetFormBuilder WordPress Plugin

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: Wordfence

Description
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to host a form configured with both a URL Query Variable preset field and a Calculated Field that references it, which are standard plugin features.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-92212
EUVD
EUVD-2026-86534

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jetformbuilder dynamic_blocks_form_builder to 3.6.5.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Reflected Cross-Site Scripting (XSS) issue in the JetFormBuilder plugin for WordPress. It occurs due to insufficient input sanitization and output escaping in the 'jfb_xss' URL query parameter via a Calculated Field. Attackers can inject malicious scripts into pages that execute when a user clicks a crafted link.

Detection Guidance

This vulnerability requires checking WordPress sites using the JetFormBuilder plugin up to version 3.6.5.3. Inspect forms for URL Query Variable preset fields and Calculated Fields referencing them. No direct network commands detect this; manual review of plugin versions and form configurations is needed.

Impact Analysis

Unauthenticated attackers could trick users into clicking a malicious link, leading to arbitrary web scripts executing in their browser. This could result in session hijacking, data theft, or defacement of affected pages. Users with forms configured with both a URL Query Variable preset field and a Calculated Field are at higher risk.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, potentially violating GDPR (data protection) and HIPAA (healthcare data privacy) requirements. Organizations using the affected plugin may face compliance breaches if user data is compromised through exploitation.

Mitigation Strategies

Update the JetFormBuilder plugin to the latest version beyond 3.6.5.3. If an update is unavailable, disable the plugin temporarily or remove forms with URL Query Variable preset fields and Calculated Fields until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-92212. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart