CVE-2026-92212: JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' (URL Query Variable) Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to host a form configured with both a URL Query Variable preset field and a Calculated Field that references it, which are standard plugin features.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
A site is exposed only on pages containing a JetFormBuilder form configured with both a URL Query Variable preset field and a Calculated Field that references that preset. These are standard plugin features, but the affected configuration must be present on the targeted page.
Does exploitation require an authenticated WordPress account?
No. An unauthenticated attacker can supply a malicious value through the jfb_xss URL query parameter, but must persuade a user to perform an action such as clicking a crafted link.
What is the impact if a user triggers the malicious link?
Arbitrary web script can execute in the context of the affected page. The reported impact includes potential loss of confidentiality and integrity, with no reported availability impact.
How can administrators identify potentially affected forms?
Review JetFormBuilder forms on the site for URL Query Variable preset fields and determine whether any Calculated Field references those values. Forms with both elements on a page are the relevant exposure condition.