JetFormBuilder EUVD-2026-86534

Exploitation requires the targeted page to host a JetFormBuilder form configured with BOTH a URL Query Variable preset field AND a Calculated Field that references that preset - without this specific pairing the 'jfb_xss' input is not reflected. The attack is unauthenticated (PR:N) and network-delivered (AV:N) but requires user interaction (UI:R): the victim must click an attacker-supplied link. These are described as standard plugin features, so the configuration is plausible on real sites but is not guaranteed on every install, which meaningfully limits the exploitable target population versus a default-config remote XSS.

This is a genuine but moderate-severity issue, not a top-priority emergency. The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) is the classic reflected-XSS profile: network-reachable and unauthenticated, but gated on user interaction (UI:R) - a victim must click an attacker-crafted link. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' There is no signal conflict here: all signals align on a low-to-moderate, opportunistic risk rather than automated mass exploitation. The one nuance beyond raw CVSS is the target-side prerequisite baked into the description - the page must host a form combining a URL Query Variable preset field with a Calculated Field that references it - which narrows the exploitable population even though those are described as standard plugin features. Bottom line: patch in normal cycles; not a drop-everything issue, but real because it is unauthenticated and reflected XSS enabling session/action abuse against site users.

An attacker crafts a URL to a JetFormBuilder-powered page that has a form using a URL Query Variable preset feeding a Calculated Field, embedding a malicious payload in the 'jfb_xss' query parameter. The attacker sends this link to a victim (phishing, comment, social media); when the victim opens it, the unsanitized value is reflected into the calculated field output and the script executes in the victim's browser session. No public exploit code was reported in the provided intelligence.