CVE-2026-97342 in JetFormBuilder Plugin
Summary
by MITRE • 10/02/2026
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The JetFormBuilder plugin for WordPress contains a critical security vulnerability affecting all versions up to 3.6.5.4, classified as Stored Cross-Site Scripting or CWE-79. This flaw arises from insufficient input sanitization and output escaping mechanisms within the plugin's core functionality. Specifically, the vulnerability is triggered through the choice post meta field during Insert or Update Post actions. The lack of proper validation allows unauthenticated attackers to inject arbitrary web scripts into pages managed by this plugin. When a user accesses an affected page containing these injected payloads, the malicious code executes in their browser context, potentially leading to session hijacking, defacement, or further malware distribution depending on the attacker's intent and the victim's privileges.
The operational mechanism of this vulnerability involves several distinct steps that exploit weaknesses in how data is handled between user input and database storage. The attack vector utilizes the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint to submit malicious payloads. Because this endpoint does not require authentication, any internet user can initiate an attack without prior access credentials. Once submitted, the payload is stored verbatim into post meta fields via the Insert or Update Post action logic within JetFormBuilder. This storage process fails to filter out dangerous script tags or event handlers, allowing the malicious code to persist in the database alongside legitimate form data.
The execution phase occurs when a user views a page containing forms built with this plugin. The Select Field block template is responsible for rendering these forms and retrieving stored values using the get_from_db option generator. This component copies raw meta values directly into HTML attribute value fields and label content without applying necessary output escaping functions such as esc_attr or wp_kses_post. Consequently, when the browser parses the rendered page, it interprets the injected scripts as executable code rather than static text. This results in the immediate execution of the attacker's payload within the context of the victim's session on the targeted WordPress site.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK techniques related to Client-Side Injection and Web Session Manipulation. Attackers can leverage this flaw for phishing campaigns by injecting forms that steal credentials or redirect users to malicious sites. It also enables persistent access if combined with other vulnerabilities, as the stored payload remains active until manually removed from the database or the plugin is updated. The impact extends beyond simple script execution; it compromises the integrity of user interactions and can lead to significant reputational damage for site owners who rely on JetFormBuilder for customer engagement or data collection processes.
Mitigation strategies must focus on immediate remediation through software updates and defensive coding practices. Site administrators should upgrade JetFormBuilder to version 3.6.5.4 or later, where the developers have addressed these sanitization and escaping deficiencies. For sites unable to update immediately due to compatibility constraints, temporary mitigations include implementing Web Application Firewall rules that detect and block attempts to inject script tags via the wp_ajax_nopriv_jet_form_builder_submit endpoint. Additionally, manual database audits can identify and remove any previously injected malicious payloads from post meta tables associated with JetFormBuilder forms.
Long-term resilience requires adherence to secure development lifecycle principles within WordPress plugin ecosystems. Developers must ensure that all user-supplied data is strictly validated upon entry using functions like sanitize_text_field or similar appropriate sanitizers depending on the expected input type. Furthermore, every instance of outputting data into HTML contexts must be escaped using context-specific escaping functions such as esc_html for text content and esc_attr for attribute values. Regular security audits and penetration testing should be conducted to identify similar patterns of insufficient validation across other plugins used within the WordPress environment. By enforcing these standards, organizations can significantly reduce their attack surface against stored cross-site scripting vulnerabilities that exploit trust in server-side data handling processes.