EUVD-2026-72646
GHSA-x584-v8v3-939r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Standard reflected XSS metrics; A:N because XSS does not cause direct availability impact on the WordPress server or victim system.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.
Articles & Coverage 2
AnalysisAI
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions through 3.6.5.1, allowing a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The CVSS vector (PR:N/UI:R/S:C) confirms no authentication is needed to craft a malicious payload, but exploitation requires social engineering to lure a logged-in user into clicking a crafted URL. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | WordPress site must have the JetFormBuilder plugin installed and active in version 3.6.5.1 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.1 score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) is broadly consistent with a reflected XSS but the A:L metric is unusual - XSS rarely causes direct availability impact unless it triggers resource exhaustion or DOM manipulation that crashes the page, and this is likely overstated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory - users should update JetFormBuilder to a version above 3.6.5.1 immediately; the exact fixed release version is not independently confirmed from the provided data and should be verified against the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-6-5-1-cross-site-scripting-xss-vulnerability) and the official WordPress plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress instances to identify JetFormBuilder deployments running versions 3.6.5.1 or earlier and document forms collecting sensitive data. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jetformbuilder
View allShortcode injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated remote attackers to execute
A Code Injection vulnerability (CWE-94) exists in JetFormBuilder versions up to and including 3.5.6.1, allowing attacker
Email header injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated attackers to manipulate
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder - Dynamic Blocks Form Builder plugin <= 3.0
Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attacker
Unauthenticated reflected/stored cross-site scripting in the JetFormBuilder WordPress plugin versions 3.6.0.1 and earlie
Privilege escalation in JetFormBuilder WordPress plugin versions 3.6.1 and earlier allows authenticated subscribers to e
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today