What’s Vulnerable › Vulnerabilities
CVE-2026-19861: JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails
- Severity: medium (CVSS 4.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-05 · updated 2026-09-08
- Weakness: CWE-79
Description
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. Whether injected script executes depends on the recipient's mail client, but the injected markup is rendered regardless.
Affected products
- JetFormBuilder — Dynamic Blocks Form Builder: before 3.6.5.2 — fixed in 3.6.5.2
How to fix
Upgrade to a fixed version: JetFormBuilder — Dynamic Blocks Form Builder 3.6.5.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-19861 or the next vulnerability affects your stack