CVE-2026-123482 · Package
NO FIX YET · SEE WHAT TO DO
JetFormBuilder, a WordPress form plugin by Crocoblock, fails to neutralize input before it is rendered in a page, which allows stored cross-site scripting. An attacker who can submit or store content can run script in the browser of anyone who later views that content.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the JetFormBuilder plugin at version 3.6.8 or earlier are exposed. The risk is stored script injected through form fields that visitors or staff later view, so sites without JetFormBuilder forms are not affected.
Not affected if plugin-not-installed, plugin-version-above-3.6.8
Who cares crocoblock, jetformbuilder, wordpress
wp plugin get jetformbuilder --field=version3.6.8 (the fixed version is not named in the sources)Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.