Live › vulnerability › CVE-2026-119479
JetFormBuilder, a form builder plugin from Crocoblock, fails to neutralize script-related HTML tags, allowing code injection into pages. An attacker can run scripts in a visitor's browser on affected sites.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 16:31 UTC. All times on this page are UTC.
Sites running JetFormBuilder up to and including version 3.6.7.1 are affected. The sources do not describe which form fields or settings are required, so unknown whether anonymous visitors can trigger it.
No product ranges from the sources yet.
3.6.7.1 and below3.6.7.1; the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
This page as .md · .json · in your agent: get_signal("CVE-2026-119479")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.