Medium severity · published Sep 25, 2026
CVE-2026-92212
JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to host a form configured with both a URL Query Variable preset field and a Calculated Field that references it, which are standard plugin features.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
JD
JetFormBuilder — Dynamic Blocks Form Builder · jetmonsters
through 3.6.5.3 · source: vendor
Affected product
JD
JetFormBuilder — Dynamic Blocks Form Builder
jetmonsters
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-92212
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-92212
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/assets/build/frontend/main.js
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/includes/blocks/render/calculated-field-render.php#L42
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/includes/presets/sources/preset-source-query-var.php#L21
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/templates/fields/calculated-field.php#L31
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?reponame=&old=3707612%40jetformbuilder&new=3707612%40jetformbuilder
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/37a72530-35d0-4fe8-82c6-50c87f61e731?source=cve
More from JetFormBuilder — Dynamic Blocks Form Builder
9.8
CVE-2026-12793
JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
7.5
CVE-2026-4373
JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field
7.2
CVE-2026-97342
JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
7.2
CVE-2024-7291
JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation
5.3
CVE-2026-13459
JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter