JetFormBuilder EUVD-2026-37636

Exploitation requires (1) a WordPress site running JetFormBuilder version 3.6.0.1 or earlier with a JetFormBuilder-generated form or endpoint reachable to unauthenticated visitors, and (2) victim user interaction - either clicking an attacker-supplied link containing the payload or loading a page where a previously injected payload is rendered (UI:R in the CVSS vector). No authentication is required to inject the payload (PR:N), but impact is meaningfully limited by the need for a victim to load the malicious content in their authenticated browser session, and by the Low C/I/A impact ratings indicating partial rather than full compromise of the targeted browser context.

The signals are mixed: CVSS 7.1 (High) with AV:N/AC:L/PR:N reflects easy network reachability without credentials, but UI:R means a victim must click or load attacker-controlled content, and C/I/A are all Low rather than High. There is no KEV entry, no published EPSS score in the provided data, and no public PoC referenced - so this is best treated as a credible but not urgent issue, more aligned with phishing-assisted account takeover than mass exploitation. The real-world priority rises sharply for sites where the affected form endpoints are linked from high-traffic pages or where administrators routinely view submitted form data in wp-admin, since a stored XSS payload could escalate to admin-session theft and full site compromise. EPSS data is missing from the input, so probabilistic exploitation likelihood cannot be quantified here.

An attacker crafts a URL or form-submission payload targeting a JetFormBuilder-rendered field on a victim WordPress site and distributes it via email, social media, or a malicious site. When a logged-in administrator or visitor follows the link, the injected JavaScript executes in their browser under the site's origin, enabling session-cookie theft, CSRF actions against wp-admin, or silent redirection. No public PoC is referenced in the available data, but CWE-79 in WordPress form plugins is a well-understood pattern, so reverse-engineering the fix once released would lower the bar quickly.