Stored Cross-Site Scripting Vulnerability in JetFormBuilder Plugin for WordPress

CVE-2026-121977

What is CVE-2026-121977?

The JetFormBuilder plugin for WordPress, specifically in versions up to and including 3.6.8, is susceptible to Stored Cross-Site Scripting (XSS) through the 'note' form field. The vulnerability arises from inadequate input sanitization and output escaping, allowing unauthorized individuals to inject harmful web scripts into pages. This manipulation can trigger malicious scripts when a user accesses the impacted page. Exploitation of this vulnerability necessitates that a user with specific privileges, namely the edit_others_posts capability, visits a specially crafted form URL that contains a post ID controlled by the attacker, often facilitated through a phishing link.

References