ChangeIntel IT change radar

Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-97342

JetFormBuilder — Dynamic Blocks Form Builder · cross-site scripting

CVSS 3.1 7.2 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

Historical advisory recorded 23 Oct 2026 15:48:27 UTC. Read the latest advisory.

cve-program · CVE-2026-97342

Published

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-97342

Published

JetFormBuilder — Dynamic Blocks Form Builder

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "jetmonsters",
                    "product": "JetFormBuilder — Dynamic Blocks Form Builder",
                    "versions": [
                        {
                            "version": "0",
                            "status": "affected",
                            "lessThanOrEqual": "3.6.5.4",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON