EUVD-2026-72646
GHSA-x584-v8v3-939r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site running JetFormBuilder <=3.6.5.1
-
DeliveryCraft malicious URL with XSS payload in vulnerable parameter
-
ExploitDeliver URL to authenticated WordPress admin via phishing
-
ExecutionVictim clicks link, plugin reflects payload unsanitized
-
PersistJavaScript executes in admin browser context
-
ImpactExfiltrate session cookie or perform privileged actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | WordPress site must have the JetFormBuilder plugin installed and active in version 3.6.5.1 or earlier. The attacker requires no account or credentials on the target site (PR:N). Exploitation is limited by the requirement for victim user interaction - a targeted user (typically an authenticated WordPress administrator or editor) must be socially engineered into clicking a crafted URL (UI:R). No non-default server configuration is required. The attack does not succeed against users who are not logged in, as the primary impact is session abuse within the browser context of an authenticated visitor. |
| Impact | The provided CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) is broadly consistent with a reflected XSS but the A:L metric is unusual - XSS rarely causes direct availability impact unless it triggers resource exhaustion or DOM manipulation that crashes the page, and this is likely overstated. Adjusted independently to A:N, the score drops to approximately 6.1. EPSS data is absent from the input; no KEV listing and no public PoC are identified, placing real-world exploitation probability on the lower end despite AV:N/PR:N. The primary realistic risk is session hijacking against authenticated WordPress administrators or editors, which could escalate to site takeover if an admin cookie is stolen. Patchstack, a credible WordPress-focused vulnerability research firm, is the sole reporting source. CVSS A:L flag warrants verification with the vendor. |
| Exploit ScenarioDerived | An attacker identifies a WordPress site running JetFormBuilder <= 3.6.5.1 and crafts a URL embedding a JavaScript payload in a vulnerable input parameter processed by the plugin. The attacker sends the link to a site administrator via phishing email; when the administrator clicks the link while authenticated, the payload executes in their browser, exfiltrating session cookies or performing actions on their behalf. No public PoC exists at time of analysis, but the unauthenticated/low-complexity nature means exploitation is straightforward for anyone familiar with reflected XSS. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions through 3.6.5.1, allowing a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The CVSS vector (PR:N/UI:R/S:C) confirms no authentication is needed to craft a malicious payload, but exploitation requires social engineering to lure a logged-in user into clicking a crafted URL. No public exploit code or CISA KEV listing is identified at time of analysis, though the plugin's wide deployment in WordPress form-building workflows elevates the realistic exposure surface.
RemediationAI
Patch available per vendor advisory - users should update JetFormBuilder to a version above 3.6.5.1 immediately; the exact fixed release version is not independently confirmed from the provided data and should be verified against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-6-5-1-cross-site-scripting-xss-vulnerability) and the official WordPress plugin repository. As a compensating control where immediate patching is not possible, deploying a web application firewall (WAF) rule to strip common XSS payloads from query parameters serviced by JetFormBuilder endpoints can reduce risk - note this may break legitimate URL-encoded form parameters. Restricting access to form-facing endpoints from untrusted networks is not practical given the public-facing nature of typical form pages. Administrators should also enable Content Security Policy headers (CSP) to limit script execution scope, reducing XSS impact even if the flaw is triggered.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
JetFormBuilder (CPE: cpe:2.3:a:crocoblock:jetformbuilder:*:*:*:*:*:*:*:*) is a WordPress block-editor and Elementor form builder plugin developed by Crocoblock. The vulnerability falls under CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning at least one user-controlled input parameter is reflected into the HTML response without adequate encoding or sanitization. The changed scope (S:C) in the CVSS vector is characteristic of XSS, where the vulnerability exists in the WordPress server-side plugin but the impact materialises in the victim's browser context - a distinct security domain. The attack vector AV:N/AC:L/PR:N indicates the malicious input can be delivered remotely with no prerequisite privilege on the target site.
Know when Jetformbuilder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Standard reflected XSS metrics; A:N because XSS does not cause direct availability impact on the WordPress server or victim system.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.
Articles & Coverage 2
Executive ViewAI
WordPress installations using JetFormBuilder plugin through version 3.6.5.1 are vulnerable to unauthenticated cross-site scripting attacks that enable credential and data theft when users click attacker-controlled links. The plugin's prevalence in customer inquiry and lead-capture forms means compromised sites risk exposing both customer data and administrative credentials. With no current vendor patch available, organizations must implement interim protections or consider disabling the plugin.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement Web Application Firewall rules blocking reflected XSS patterns on form endpoints; (2) Deploy strict Content Security Policy headers (script-src: 'self'; object-src: 'none'); (3) Disable plugin on non-critical installations; (4) Enforce multi-factor authentication for administrator and form-editor accounts; (5) Monitor form submission logs and outbound scripts for JavaScript injection patterns; (6) Educate users to avoid clicking form URLs in unsolicited communications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Jetformbuilder
View allPrivilege escalation in JetFormBuilder WordPress plugin versions 3.6.1 and earlier allows authenticated subscribers to e
Shortcode injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated remote attackers to execute
A Code Injection vulnerability (CWE-94) exists in JetFormBuilder versions up to and including 3.5.6.1, allowing attacker
Email header injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated attackers to manipulate
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder - Dynamic Blocks Form Builder plugin <= 3.0
Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attacker
Unauthenticated reflected/stored cross-site scripting in the JetFormBuilder WordPress plugin versions 3.6.0.1 and earlie
Cross-site scripting in the JetFormBuilder WordPress plugin through version 3.6.5.4 allows unauthenticated attackers to
Cross-site scripting (CWE-80, basic XSS) in Crocoblock JetFormBuilder through 3.6.7.1 allows a remote attacker to inject
Missing authorization in Crocoblock JetFormBuilder through 3.6.7.1 allows remote unauthenticated attackers to perform a
Exploit-DB