JetFormBuilder CVE-2026-102391

Exploitation targets the JetFormBuilder WordPress plugin at version 3.6.5.4 or earlier. No authentication is required (PR:N), but successful exploitation depends on user interaction (UI:R) - a victim must view or interact with the page/link carrying the attacker-supplied payload for the script to execute. The limiting factors are this required interaction and the Low-impact, browser-context nature of XSS: the attacker gains no direct server-side code execution or privileged access, only actions within the victim's authenticated session. Presence of the vulnerable plugin on the WordPress site is the core prerequisite; no special non-default configuration is indicated by the description.

Signals point to a real but moderate-severity web vulnerability rather than a critical, mass-exploitable one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) reflects a classic unauthenticated Cross-Site Scripting flaw: network-reachable, low complexity, no privileges, but requiring victim interaction (UI:R) and yielding only Low confidentiality/integrity/availability impact with a scope change (S:C) because injected script executes in the victim's browser context outside the vulnerable component. No EPSS score, no CISA KEV listing, and no public POC are provided, so exploitation status is 'no public exploit identified at time of analysis' - this is a Patchstack-catalogued plugin bug, not a confirmed in-the-wild threat. The 'unauthenticated' qualifier is confirmed from the CVSS vector (PR:N), which is the notable risk driver: no account is needed, only that a victim (often an admin or visitor) interacts with the malicious input/link. There are no conflicting signals - description (unauthenticated XSS) and CVSS vector agree. Overall this is a moderate-priority patch-management item typical of WordPress plugin XSS: broadly reachable but interaction-gated and limited in direct impact.

An unauthenticated attacker submits or crafts input to a JetFormBuilder form/endpoint that is rendered without proper sanitization, embedding a malicious script payload. When an administrator or other user views the affected page (e.g., a form entry or a page reflecting the attacker's input), the script executes in their browser, enabling session/cookie theft, admin action forgery, or content manipulation. No public exploit code is identified, but XSS in a WordPress plugin of this class is straightforward to weaponize given the input vector.