Stored Cross-Site Scripting Vulnerability in JetFormBuilder Plugin for WordPress

CVE-2026-119183

What is CVE-2026-119183?

The JetFormBuilder plugin for WordPress has a Stored Cross-Site Scripting vulnerability due to inadequate input sanitization and output escaping of the '<form field mapped to a post meta key, e.g. lst_cost>' parameter. This security flaw affects all versions up to 3.6.8 and allows unauthenticated attackers to inject malicious web scripts into pages. When a vulnerable site has a publicly configured Insert Post form that writes to a post meta key and includes a Calculated Field referencing that key via the %META::key% macro, exploitation can occur. A single unauthenticated POST request is sufficient to persist and execute the injected payload, compromising the security of any user who accesses the affected page.

References