Stored cross-site scripting in JetFormBuilder via post meta macro
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
JetFormBuilder, the Dynamic Blocks Form Builder plugin for WordPress, is affected up to and including 3.6.8. Missing input sanitization and output escaping (CWE-79) let an unauthenticated attacker store scripts through a form field mapped to a post meta key. The script runs when a user opens the injected page, and one unauthenticated POST is enough on a site with a public Insert Post form and a matching Calculated Field.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<form field mapped to a post meta key, e.g. lst_cost>' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to have configured a public Insert Post form writing to a post meta key and a Calculated Field whose formula references that key via the %META::key% macro, after which a single unauthenticated POST is sufficient to persist the payload.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jetmonsters | JetFormBuilder — Dynamic Blocks Form Builder | up to 3.6.8 | — | No fix listed | CNA |
- JetFormBuilder — Dynamic Blocks Form Builder Vendorjetmonsters Affected up to 3.6.8 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for JetFormBuilder (Dynamic Blocks Form Builder).
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Timeline
- 2026-11-07 Threatist record created from CVE-2026-119183
- 2026-11-07 Alias added: GHSA-x99m-6rm8-rwmq
- 2026-11-07 CISA SSVC decision points changed
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/3b3d2e0d-ce2a-48cd-a36f-92979335fd71?source=cve
- https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/templates/fields/calculated-field.php#L31
- https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/includes/blocks/render/calculated-field-render.php#L56
- https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/modules/actions-v2/insert-post/properties/post-meta-property.php#L157
- https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/modules/actions-v2/insert-post/insert-post-action.php#L53
- https://plugins.trac.wordpress.org/changeset/3788241/jetformbuilder/trunk/includes/blocks/render/calculated-field-render.php
More jetmonsters vulnerabilities
- TI-2024-04107 Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injection CVSS 3.1CRITICAL 9.8
- TI-2026-10932 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter CVSS 3.1CRITICAL 9.8
- TI-2024-03126 Timetable and Event Schedule by MotoPress <= 2.4.11 - Authenticated (Contributor+) SQL Injection CVSS 3.1CRITICAL 9.9
- TI-2026-25053 WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.9
- TI-2025-40603 WordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerability CVSS 3.1CRITICAL 9.1
- TI-2025-22116 WordPress Restaurant Menu by MotoPress plugin <= 2.4.4 - Local File Inclusion vulnerability CVSS 3.1HIGH 8.8
Sources
- CVE-2026-119183 · CVE Program
- CVE-2026-119183 · NVD
- GHSA-x99m-6rm8-rwmq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences