JetFormBuilder CVE-2026-19861

The target site must have JetFormBuilder installed in a version prior to 3.6.5.2, with at least one active form configured to send HTML notification emails. The form must be publicly accessible without authentication (PR:N holds when no login is required to submit). Exploitation is additionally conditioned on the notification recipient opening the email in a mail client that renders HTML; clients enforcing plain-text-only or stripping HTML (common in corporate mail gateways) render the injected markup inert. No authentication, no server-side code execution, and no persistent storage of the payload on the server are involved-the entire impact is client-side within the recipient's email context.

The NVD CVSS score of 4.7 (Medium) with AC:H is an accurate reflection of real-world exploitation complexity: impact is fully contingent on the administrator's email client rendering HTML, which varies widely across organizations. The EPSS score of 0.18% (8th percentile) confirms that despite a publicly available WPScan proof-of-concept, actual exploitation attempts are not observed at scale. The vulnerability is absent from CISA KEV. The C:L/I:L impact caps are appropriate-the primary attack surface is HTML-based phishing, spoofed admin warnings, or embedded malicious links within the notification email; JavaScript execution is possible but not guaranteed. Automatable at scale against mass-vulnerable sites is constrained by the UI:R requirement (admin must open the email). This is a real but low-urgency risk for most deployments; elevated urgency applies to sites with high-value administrative targets or sensitive operational workflows.

An unauthenticated attacker visits a WordPress site running a vulnerable JetFormBuilder version and submits a publicly accessible form, injecting HTML or JavaScript payloads into text fields such as a name or message input. The plugin constructs an HTML notification email embedding the raw field values and sends it to the configured administrator address. When the administrator opens the email in an HTML-rendering client, the injected markup renders-displaying a spoofed credential prompt, silently loading an external tracking pixel, or in permissive clients executing JavaScript to redirect the admin to a phishing page. A public PoC is available via WPScan.