Crocoblock JetFormBuilder CVE-2026-119479

Exploitation requires the target site to run Crocoblock JetFormBuilder at or below version 3.6.7.1 and to expose a path where script-related HTML tags submitted through the plugin are stored or reflected without neutralization. The available sources do not name the exact form field, endpoint, or configuration that triggers the injection, nor whether contributor/author-level authentication is needed, so the precise prerequisite cannot be confirmed from the provided data. Realistic limiting factors for XSS of this type: a victim typically must view the injected content for the script to fire (victim interaction), and impact is confined to the browser session of whoever renders the payload. The input vector's claim of no user interaction (UI:N) is inconsistent with typical XSS and should be verified against the Patchstack advisory.

This is a moderate-severity cross-site scripting / content-injection flaw (CWE-80, Basic XSS) in the JetFormBuilder WordPress plugin, scored CVSS 5.3. The supplied vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates a network-reachable, low-complexity issue, but it is internally questionable for an XSS bug: it claims no user interaction (UI:N), no scope change (S:U), and only a confidentiality impact (C:L) with no integrity impact (I:N), whereas script injection typically requires a victim to render the payload (UI:R), crosses a security boundary into the victim's browser (S:C), and primarily harms integrity (I:L). Treat the input vector as approximate. No EPSS probability was provided, the CVE is not in CISA KEV, and no working exploit was supplied - only a Patchstack advisory reference, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month', consistent with a real but non-emergency issue: a widely used plugin with a disclosed XSS, but no evidence of active exploitation or mass automation. Net: a genuine patch-this-month item for WordPress operators running JetFormBuilder, not a drop-everything emergency.

An attacker injects script-bearing content through JetFormBuilder (for example via a form field or form-rendered content that is not properly neutralized); when a site user or administrator views the affected page or submission, the attacker's script executes in their browser. No working exploit code was provided - only a Patchstack advisory reference - and the exact injection point and trigger are not described in the available sources.