CVE-2026-97342

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.6.5.4 . The root cause is insufficient input sanitization and output escaping within the 'choice' Post Meta via the Insert/Update Post Act...

EUVD-2026-91250

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-97342 JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-97342: Improper Neutralization of Input During Web Page Generation

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-104150

Name of the Vulnerable Software and Affected Versions JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress versions prior to 3.6.5.5 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can...

CVE-2026-102391

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.4 versions...

CVE-2026-102391 WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.4 versions...

CVE-2026-102391

The JetFormBuilder WordPress plugin (versions ¦3.6.5.4 ) is vulnerable to an unauthenticated Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute malicious scripts in a user's browser. No specific root cause, affected functions, or remediation details are prov...

EUVD-2026-90224

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.4 versions...

CVE-2026-102391 WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.4 versions...

WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin JetFormBuilder versions = 3.6.5.4...

CVE-2026-102391: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.4 versions...

PT-2026-103489

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.4 versions...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.5.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin JetFormBuilder versions = 3.6.5.3...

CVE-2026-92212

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-92212

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 3.6.5.3 . The root cause is insufficient input sanitization and output escaping involving the 'jfb_xss' (URL Query Variable) Parameter vi...

EUVD-2026-86534

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-92212 JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-92212 JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...

PT-2026-98368

Name of the Vulnerable Software and Affected Versions JetFormBuilder versions prior to 3.6.5.4 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting XSS, a technique where malicious scripts are injected into a web...