Description

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-08T08:17:13.393Z",
  "pubdate": "2026-09-08T08:17:13.393Z",
  "executiveSummary": "JetFormBuilder versions 3.6.5.1 and earlier are susceptible to an unauthenticated Stored or Reflected Cross-Site Scripting (XSS) vulnerability. This security flaw resides within the plugin's data processing mechanisms, allowing unauthenticated attackers to inject malicious JavaScript payloads into the application.\nThe impact of this vulnerability is critical, as it enables the execution of arbitrary script code within the context of a victim's browser session. By successfully exploiting this flaw, an attacker can bypass traditional security controls to perform unauthorized actions on behalf of authenticated administrators, hijack session cookies, or redirect users to malicious domains.\nThe vulnerability requires no authentication or special privileges, significantly increasing its risk profile. As it allows for the manipulation of the document object model (DOM) via crafted form inputs or parameters, it poses a direct threat to the integrity and confidentiality of the WordPress environment utilizing the plugin. Organizations are exposed to potential site-wide compromise if administrative sessions are targeted.",
  "technicalDetails": "The vulnerability is rooted in the insufficient sanitization and validation of user-supplied input handled by JetFormBuilder. The plugin fails to properly escape input fields or parameters before reflecting them in the HTML response or storing them in the database for later rendering. This failure enables the injection of arbitrary HTML or JavaScript tags, which the browser interprets as executable code rather than plain text.\nThe attack flow commences when an unauthenticated attacker identifies a vulnerable entry point, such as a form submission field or an URL parameter processed by the plugin's frontend or backend logic. By crafting a payload containing malicious script tags (e.g., <script>alert(document.cookie)</script>), the attacker submits this input to the server. Due to the lack of output encoding or sanitization, the application stores or reflects this payload within the administrative dashboard or public-facing pages.\nWhen a legitimate user, typically an administrator, interacts with the affected component, the malicious script is executed within their browser. Because the script runs in the context of the authenticated user's session, the attacker gains the ability to perform actions such as modifying plugin configurations, creating new administrator accounts, or exfiltrating sensitive data stored within the WordPress backend.\nThe vulnerable component is identified within the processing logic of JetFormBuilder, which processes form data without enforcing context-aware output encoding. The vulnerability is present in versions <= 3.6.5.1. The lack of stringent input validation allows for the bypass of security filters, facilitating the injection of complex payloads. Exploitation is remote and requires no prior network-level access or user authentication, making the attack surface broad. Post-exploitation impact is limited only by the privileges of the user targeted, essentially granting the attacker the equivalent permissions of the victim."
}