Skip to content
Sign in
4.7 Medium

CVE-2026-103912 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site…

Description

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '<attacker-chosen query var name matching the preset's query_var setting>' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on pages embedding a form that has a text field configured with a query_var Dynamic Preset and a data-jfb-macro or JFB_FIELD:: macro reference targeting that field, both of which are standard, documented plugin features.

Affected products and versions

Product Affected versions Fixed in
JetFormBuilder — Dynamic Blocks Form Builder 3.6 earliest → 3.6.6 No fix stated

Other CVEs of JetFormBuilder — Dynamic Blocks Form Builder

The 9 CVEs of JetFormBuilder — Dynamic Blocks Form Builder →
CVE-2026-120561 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data… 5.3 Medium CVE-2026-97342 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… 7.2 High CVE-2026-92212 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting… 6.1 Medium CVE-2026-12793 The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all… 9.8 Critical
Track this CVE