CVE-2026-19859: JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter
The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later shortcode-expansion pass rather than after it, so the escaping can be bypassed.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using JetFormBuilder versions earlier than 3.6.5.2 are affected on pages that display a form. Exploitation is possible without authentication.
What does an attacker need to exploit it?
An attacker needs to send a request containing a crafted status parameter to a page displaying a JetFormBuilder form. No credentials or user interaction are required.
What is the impact of successful exploitation?
An attacker can execute arbitrary shortcodes that are registered on the affected site. The stated impact includes limited confidentiality and integrity impact, with no availability impact.