Skip to content
Sign in
4.7 Medium

CVE-2026-19861 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a…

Description

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. Whether injected script executes depends on the recipient's mail client, but the injected markup is rendered regardless.

Affected products and versions

Product Affected versions Fixed in
JetFormBuilder — Dynamic Blocks Form Builder 3.6 earliest → < 3.6.5.2 3.6.5.2

Other CVEs of JetFormBuilder — Dynamic Blocks Form Builder

The 3 CVEs of JetFormBuilder — Dynamic Blocks Form Builder →
CVE-2026-19860 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which… 5.5 Medium CVE-2026-19858 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks… 7.5 High
Track this CVE