EUVD-2026-71847
GHSA-j6wc-w47f-c97j
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Provided vector is accurate: AC:H reflects mail-client HTML rendering dependency; UI:R requires admin to open the email; S:C captures cross-context scope change to email client.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. Whether injected script executes depends on the recipient's mail client, but the injected markup is rendered regardless.
AnalysisAI
HTML injection via unsanitized email notifications in JetFormBuilder WordPress plugin (versions before 3.6.5.2) allows unauthenticated form submitters to embed arbitrary HTML-and conditionally JavaScript-into notification emails delivered to administrators and other configured recipients. The scope change is real: a public form submission influences the admin's email client environment rather than the WordPress server itself, with JavaScript execution gated on the recipient's mail client rendering capability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target site must have JetFormBuilder installed in a version prior to 3.6.5.2, with at least one active form configured to send HTML notification emails. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS score of 4.7 (Medium) with AC:H is an accurate reflection of real-world exploitation complexity: impact is fully contingent on the administrator's email client rendering HTML, which varies widely across organizations. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade JetFormBuilder to version 3.6.5.2 or later via the WordPress plugin dashboard or the WordPress.org plugin repository; this is the vendor-confirmed patched release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
JetFormBuilder - Dynamic Blocks Form Builder for WordPress before version 3.6.5.2 exposes sensitive site data to unauthe
The JetFormBuilder plugin for WordPress contains a critical path traversal vulnerability allowing unauthenticated attack
Unauthorized wp_postmeta enumeration in JetFormBuilder (WordPress plugin, all versions through 3.6.3) allows unauthentic
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today