What is the CVSS score of CVE-2026-54195?

CVE-2026-54195 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of JetFormBuilder are affected by CVE-2026-54195?

JetFormBuilder WordPress plugin versions 3.6.0.1 and earlier contain a cross-site scripting vulnerability allowing attackers to inject malicious scripts when victims interact with crafted links or…

How to fix or mitigate CVE-2026-54195?

Within 24 hours: Audit all WordPress installations running JetFormBuilder 3.6.0.1 or earlier; disable the plugin and assess which pages are affected. Within 7 days: Implement Content Security Policy headers and deploy Web Application Firewall rules to block XSS payloads; notify potentially affected users of the vulnerability. Within 30 days: Monitor vendor security advisories for a patch; apply immediately upon release and validate remediation before re-enabling the plugin.

JetFormBuilder CVE-2026-54195

EUVD-2026-37636 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-17 Patchstack

WordPress XSS Jetformbuilder Wordpress Plugin Jetmonsters

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-reachable WordPress form (AV:N/AC:L), no auth needed to inject (PR:N), victim click required (UI:R), scope-changed XSS in site origin yields limited C/I/A.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:55 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions.

AnalysisAI

Unauthenticated reflected/stored cross-site scripting in the JetFormBuilder WordPress plugin versions 3.6.0.1 and earlier allows remote attackers to inject script into pages rendered to victims. Exploitation requires a victim to interact with a crafted link or form (UI:R), and successful payload execution can hijack sessions or perform actions in the victim's browser context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

JetFormBuilder is a Crocoblock/JetMonsters WordPress plugin (CPE cpe:2.3:a:jetmonsters:jetformbuilder) used to build dynamic forms, including front-end posting, payment, and user-registration forms. The flaw is classed as CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input is rendered into HTML output without sufficient escaping or sanitization. Because the CVSS vector marks the issue as unauthenticated (PR:N), the unsanitized input is reachable on a public-facing form or endpoint exposed by the plugin, and the Scope:Changed metric indicates the injected script executes in the WordPress site's origin rather than the plugin's own sandboxed context.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data - administrators should monitor the JetFormBuilder changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-6-0-1-cross-site-scripting-xss-vulnerability) for a release above 3.6.0.1 and upgrade immediately when available. As compensating controls until a fix ships, deploy a WAF rule (Patchstack, Wordfence, or equivalent) that blocks XSS payloads on the plugin's form-submission and AJAX endpoints, restrict the form pages to authenticated users via page-level access control where the business flow allows it (this breaks public form submissions, so weigh against use case), and enforce a strict Content-Security-Policy with script-src 'self' to reduce inline-script execution (note this may break other plugins that rely on inline scripts and should be tested in staging). Site administrators should also avoid clicking links to their own site received via email or chat until patched, since admin-context script execution would be the highest-impact outcome.