CVE-2026-123482: WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetFormBuilderto a version that resolves this vulnerability.Fixed in 3.6.8.1
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The vector is network-based, requires low attack complexity, and does not require authentication or privileges. Exploitation does require user interaction.
Which installations are affected?
JetFormBuilder versions through 3.6.8 are affected. The provided information does not identify a safe fixed version or any configuration prerequisites.
What impact can successful exploitation have?
This is a stored XSS issue with low confidentiality, integrity, and availability impact. The scope is changed, meaning the vulnerable component can affect another security authority.