CVE-2026-97342
Received Received - Intake

Stored Cross-Site Scripting in JetFormBuilder WordPress Plugin

Publication date: 2026-10-02

Last updated on: 2026-10-02

Assigner: Wordfence

Description
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-02
Last Modified
2026-10-02
Generated
2026-10-02
AI Q&A
2026-10-02
EPSS Evaluated
N/A
NVD
CVE-2026-97342
EUVD
EUVD-2026-91250

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jetformbuilder dynamic_blocks_form_builder to 3.6.5.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Stored Cross-Site Scripting (XSS) vulnerability in the JetFormBuilder WordPress plugin. It allows unauthenticated attackers to inject malicious scripts into web pages via the 'choice' Post Meta field. The payload is submitted through an unauthenticated endpoint, stored in post meta, and later executed when users access the affected page. The issue stems from insufficient input sanitization and output escaping.

Detection Guidance

Check for unauthorized scripts in WordPress post meta by querying the database for suspicious entries in the 'wp_postmeta' table with meta_key containing 'choice'. Inspect pages using the Select Field block for unexpected JavaScript in value or label attributes.

Impact Analysis

Attackers could steal user sessions, redirect users to malicious sites, or perform actions on their behalf. Since the payload executes when a user visits an infected page, it can affect all visitors, including administrators. The vulnerability requires no authentication to exploit, increasing the risk of widespread impact.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Unauthorized script execution may expose sensitive user data, resulting in regulatory fines and legal consequences for non-compliance.

Mitigation Strategies

Update the JetFormBuilder plugin to the latest version, which includes fixes for the XSS vulnerability. Review and sanitize any stored form submissions or post meta data for malicious scripts. Implement additional input validation and output escaping in WordPress forms.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97342. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart