CVE-2026-123484: WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress JetFormBuilderto a version that resolves this vulnerability.Fixed in 3.6.8.1
Event History
Frequently Asked Questions
Which installations are affected?
JetFormBuilder versions through 3.6.8 are affected. The affected product is the Crocoblock JetFormBuilder WordPress plugin.
What does exploitation require?
The vulnerability is a DOM-based cross-site scripting issue with network attack vector, low attack complexity, no required privileges, and required user interaction. An attacker would need a user to interact with crafted content or input for the XSS to execute.
How can I determine whether my site is affected?
Check the installed JetFormBuilder plugin version. Sites running version 3.6.8 or an earlier affected version should be treated as affected.