JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-97342 · Microsoft / collected KEV context

cve-program · CVE-2026-97342

• https://www.wordfence.com/threat-intel/vulnerabilities/id/84857045-833f-44fb-ada0-1e0f4eb84a52?source=cve
• https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/modules/option-field/blocks/select/block-template.php#L131
• https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/includes/form-handler.php#L85
• https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/includes/classes/tools.php#L574
• https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/modules/actions-v2/insert-post/properties/post-meta-property.php#L152
• https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/includes/generators/get-from-db.php#L226
• https://github.com/Crocoblock/jetformbuilder/commit/534c2ce996408d1f9b5a9fba165348a7cd38bccc#diff-f60e64a78a96f00501af389dc216067c8335cd91ee7296e6c7d960f89dae7d20R547-R551

No related operational record is retained in the current change model.