{"id":"CVE-2026-119479","kind":"vulnerability","aliases":["CVE-2026-119479"],"related":[],"title":"JetFormBuilder WordPress plugin: basic XSS lets attackers inject script","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.","summary":"JetFormBuilder, a form builder plugin from Crocoblock, fails to neutralize script-related HTML tags, allowing code injection into pages. An attacker can run scripts in a visitor's browser on affected sites.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crocoblock","jetformbuilder","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin plugin list against the range `3.6.7.1` and below","fix":"- Move JetFormBuilder past `3.6.7.1`; the sources do not name the fixed version","status":"open","published_at":"2026-10-30T16:17:45+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","triaged_at":"2026-10-30T16:32:28+00:00","updated_at":"2026-10-30T16:32:28+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-30T16:32:28Z","model":"claude-haiku-5-5","output":{"fix":"- Move JetFormBuilder past `3.6.7.1`; the sources do not name the fixed version","reach":"internet","title":"JetFormBuilder WordPress plugin: basic XSS lets attackers inject script","impact":"medium","summary":"JetFormBuilder, a form builder plugin from Crocoblock, fails to neutralize script-related HTML tags, allowing code injection into pages. An attacker can run scripts in a visitor's browser on affected sites.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","jetformbuilder","crocoblock"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker injects scripts that run in visitors' browsers.","analyst_note":"Check the NVD entry and Crocoblock advisory for the fixed version and whether unauthenticated input reaches the output.","how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin plugin list against the range `3.6.7.1` and below\n- unknown for other checks; the sources do not say which form or setting is involved","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running JetFormBuilder up to and including version 3.6.7.1 are affected. The sources do not describe which form fields or settings are required, so unknown whether anonymous visitors can trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000686,"input_tokens":4132,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119479':12A,15A '-2026':11A,14A '3.6.7.1':81C 'affect':51B,76C 'allow':35B,72C 'attack':7A,41B 'basic':4A,65C 'browser':49B 'builder':23B 'code':36B,73C 'crocoblock':16B,26B,69C 'cve':10A,13A 'fail':27B 'form':22B 'html':33B,59C 'improp':53C 'inject':8A,37B 'injection.this':74C 'issu':75C 'jetformbuild':1A,17B,20B,70C,71C,77C 'let':6A 'n/a':79C 'neutral':29B,54C 'page':39B,64C 'plugin':3A,24B 'relat':32B,58C 'run':43B 'script':9A,31B,44B,57C 'script-rel':30B,56C 'site':52B 'tag':34B,60C 'visitor':47B 'vulner':67C 'web':63C 'wordpress':2A,19B 'xss':5A,66C","nicknames":[],"mitigations":[],"who_affected":"Sites running JetFormBuilder up to and including version 3.6.7.1 are affected. The sources do not describe which form fields or settings are required, so unknown whether anonymous visitors can trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T16:17:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119479","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119479","severity":null,"published_at":"2026-10-30T16:17:45+00:00","modified_at":"2026-10-30T16:17:45+00:00","first_seen_at":"2026-10-30T16:31:26+00:00","fetched_at":"2026-10-30T16:31:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}