Description

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to host a form configured with both a URL Query Variable preset field and a Calculated Field that references it, which are standard plugin features.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-25T07:16:55.337Z",
  "pubdate": "2026-09-25T07:16:55.337Z",
  "executiveSummary": "The JetFormBuilder plugin for WordPress contains a Reflected Cross-Site Scripting (XSS) vulnerability impacting all versions up to and including 3.6.5.3.\nThe flaw originates from improper sanitization and output escaping of the 'jfb_xss' URL query variable when processed through a Calculated Field.\nThis vulnerability allows unauthenticated remote attackers to execute arbitrary JavaScript within the context of a victim's browser session.\nThe attack is contingent upon social engineering, as it requires an authenticated or unauthenticated user to click a specially crafted URL leading to a page hosting a form configured with both a URL Query Variable preset and a referencing Calculated Field.\nSuccessful exploitation can lead to unauthorized actions performed on behalf of the user, session hijacking, credential theft, or redirection to malicious sites.\nGiven the nature of XSS, the risk is classified as significant, particularly for users with administrative or elevated privileges who may inadvertently execute the payload while managing the site.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the JetFormBuilder plugin to implement adequate input validation and context-aware output encoding for the 'jfb_xss' parameter.\nWhen a WordPress page hosts a form configured with a field set to accept a 'URL Query Variable' preset, the plugin retrieves data directly from the GET request.\nIf this variable is subsequently included in a 'Calculated Field' calculation or output, the plugin fails to sanitize the input properly, treating the provided string as trusted data.\nAn attacker can exploit this by crafting a malicious URL containing the 'jfb_xss' parameter injected with JavaScript payloads (e.g., <script>alert(document.domain)</script>).\nThe attack flow proceeds as follows: 1) The attacker identifies a target site using JetFormBuilder with the aforementioned form configuration. 2) The attacker crafts a payload-bearing URL utilizing the 'jfb_xss' parameter. 3) The attacker induces a target user to navigate to the crafted URL via phishing, email, or other social engineering vectors. 4) The plugin processes the URL parameter and renders it into the DOM within the Calculated Field component without stripping executable script tags. 5) The victim's browser parses and executes the injected script.\nBecause the payload is reflected directly in the browser's document object model, the script executes within the security context of the victim's session on the target website.\nThis exposure is strictly network-based, requiring the attacker to have public access to the WordPress instance. No authentication or elevated administrative privileges are required to initiate the attack, as the vulnerability exists in the public-facing rendering of the form.\nPost-exploitation impacts include the ability to bypass Cross-Site Request Forgery (CSRF) protections, capture sensitive cookies, modify the displayed page content, or initiate asynchronous HTTP requests to perform administrative actions if the victim is an authenticated administrator."
}