CVE-2026-119183 in JetFormBuilder Plugin
Summary
by MITRE • 11/07/2026
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<form field mapped to a post meta key, e.g. lst_cost>' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to have configured a public Insert Post form writing to a post meta key and a Calculated Field whose formula references that key via the %META::key% macro, after which a single unauthenticated POST is sufficient to persist the payload.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/07/2026
The JetFormBuilder plugin for WordPress contains a critical security vulnerability classified as Stored Cross-Site Scripting within versions up to and including 3.6.8. This flaw stems from insufficient input sanitization and output escaping mechanisms when processing specific form parameters, specifically affecting the dynamic blocks functionality that allows users to create complex forms with calculated fields and post meta integration. The vulnerability is particularly severe because it does not require any authentication, allowing unauthenticated attackers to exploit the issue remotely without prior access credentials or user interaction beyond a single HTTP request.
The technical root cause lies in how the plugin handles data written to WordPress post metadata via public Insert Post forms combined with Calculated Fields that reference those meta keys using the %META::key% macro. When an attacker submits a POST request containing malicious JavaScript payloads within the targeted parameter, the application fails to properly sanitize this input before storage and subsequently fails to escape it when rendering the content in subsequent page views. This dual failure allows arbitrary web scripts to be persisted directly into the database associated with specific posts or forms.
From an operational impact perspective, once the payload is stored, any user who accesses a page containing the affected form or post will have their browser execute the injected script within the context of the vulnerable website. This can lead to session hijacking through cookie theft, allowing attackers to impersonate legitimate users and gain unauthorized access to administrative accounts if those cookies are captured. It also enables defacement of web pages, redirection to malicious sites for phishing attacks, or the execution of further client-side exploits such as keylogging or browser fingerprinting. The persistence of this data means that every subsequent visit by any user serves as a potential attack vector until the compromised content is manually removed from the database.
This vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting (XSS), specifically in its stored variant where malicious scripts are permanently stored on the target server. In terms of adversary tactics, this exploitation path corresponds to ATT&CK technique T1059 Command and Scripting Interpreter via browser-based execution, allowing attackers to leverage client-side environments for further compromise or data exfiltration. The requirement for a specific configuration involving public Insert Post forms and calculated fields indicates that the attack surface is somewhat constrained but still significant for sites utilizing these dynamic features publicly.
To mitigate this risk, site administrators should immediately update JetFormBuilder to version 3.6.9 or later where input sanitization and output escaping have been corrected. For organizations unable to patch immediately due to compatibility concerns, temporary mitigations include disabling public Insert Post forms that write to post meta keys accessible via calculated fields until the update can be applied. Additionally, implementing a Web Application Firewall with rules capable of detecting and blocking common XSS payloads in POST requests may provide an additional layer of defense against exploitation attempts while ensuring strict content security policies are enforced on affected pages to limit script execution contexts.