{"id":"CVE-2026-123482","kind":"vulnerability","aliases":["CVE-2026-123482"],"related":[],"title":"JetFormBuilder: stored cross-site scripting through form input, up to 3.6.8","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.","summary":"JetFormBuilder, a WordPress form plugin by Crocoblock, fails to neutralize input before it is rendered in a page, which allows stored cross-site scripting. An attacker who can submit or store content can run script in the browser of anyone who later views that content.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crocoblock","jetformbuilder","package","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-above-3.6.8"],"how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin plugins list or `wp plugin get jetformbuilder --field=version`\n- Confirm whether the plugin version is 3.6.8 or earlier","fix":"- JetFormBuilder: move to a version later than `3.6.8` (the fixed version is not named in the sources)","status":"open","published_at":"2026-11-09T17:17:27+00:00","first_seen_at":"2026-11-09T17:27:39+00:00","triaged_at":"2026-11-09T17:28:48+00:00","updated_at":"2026-11-09T17:28:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T17:28:48Z","model":"claude-haiku-5-5","output":{"fix":"- JetFormBuilder: move to a version later than `3.6.8` (the fixed version is not named in the sources)","reach":"internet","title":"JetFormBuilder: stored cross-site scripting through form input, up to 3.6.8","impact":"medium","summary":"JetFormBuilder, a WordPress form plugin by Crocoblock, fails to neutralize input before it is rendered in a page, which allows stored cross-site scripting. An attacker who can submit or store content can run script in the browser of anyone who later views that content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","jetformbuilder","crocoblock"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in other users' browsers, enabling session theft","analyst_note":"Find the fixed version and the auth requirement for JetFormBuilder 3.6.8 in the NVD entry or the Crocoblock changelog.","how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin plugins list or `wp plugin get jetformbuilder --field=version`\n- Confirm whether the plugin version is 3.6.8 or earlier","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-version-above-3.6.8"],"who_is_affected":"Sites running the JetFormBuilder plugin at version 3.6.8 or earlier are exposed. The risk is stored script injected through form fields that visitors or staff later view, so sites without JetFormBuilder forms are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000763,"input_tokens":4552,"output_tokens":615,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123482':15A,18A '-2026':14A,17A '3.6.8':12A,95C 'affect':90C 'allow':42B,86C 'anyon':63B 'attack':49B 'browser':61B 'content':55B,68B 'crocoblock':19B,29B,83C 'cross':4A,45B,78C 'cross-sit':3A,44B,77C 'cve':13A,16A 'fail':30B 'form':8A,26B 'generat':76C 'improp':69C 'input':9A,33B,72C 'issu':89C 'jetformbuild':1A,20B,23B,84C,85C,91C 'later':65B 'n/a':93C 'neutral':32B,70C 'packag':21B 'page':40B,75C 'plugin':27B 'render':37B 'run':57B 'script':6A,47B,58B,80C 'site':5A,46B,79C 'store':2A,43B,54B,87C 'submit':52B 'view':66B 'vulner':81C 'web':74C 'wordpress':22B,25B 'xss.this':88C","nicknames":[],"mitigations":[],"who_affected":"Sites running the JetFormBuilder plugin at version 3.6.8 or earlier are exposed. The risk is stored script injected through form fields that visitors or staff later view, so sites without JetFormBuilder forms are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crocoblock","high","jetformbuilder","package","wordpress"],"campaign_type":null,"search_a":"'-123482':15A,18A '-2026':14A,17A '3.6.8':12A 'cross':4A 'cross-sit':3A 'cve':13A,16A 'form':8A 'input':9A 'jetformbuild':1A 'script':6A 'site':5A 'store':2A","search_b":"'allow':42B 'anyon':63B 'attack':49B 'browser':61B 'content':55B,68B 'crocoblock':19B,29B 'cross':45B 'cross-sit':44B 'fail':30B 'form':26B 'input':33B 'jetformbuild':20B,23B 'later':65B 'neutral':32B 'packag':21B 'page':40B 'plugin':27B 'render':37B 'run':57B 'script':47B,58B 'site':46B 'store':43B,54B 'submit':52B 'view':66B 'wordpress':22B,25B","search_c":"'3.6.8':95C 'affect':90C 'allow':86C 'crocoblock':83C 'cross':78C 'cross-sit':77C 'generat':76C 'improp':69C 'input':72C 'issu':89C 'jetformbuild':84C,85C,91C 'n/a':93C 'neutral':70C 'page':75C 'script':80C 'site':79C 'store':87C 'vulner':81C 'web':74C 'xss.this':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123482","severity":null,"published_at":"2026-11-09T17:17:27+00:00","modified_at":"2026-11-09T17:17:27+00:00","first_seen_at":"2026-11-09T17:27:39+00:00","fetched_at":"2026-11-09T17:27:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}