{"id":"CVE-2026-123483","kind":"vulnerability","aliases":["CVE-2026-123483"],"related":[],"title":"JetFormBuilder: basic XSS lets script injection through web page forms","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.","summary":"JetFormBuilder, a WordPress form plugin from Crocoblock, fails to neutralize script-related HTML tags in some pages. An attacker can inject code that runs in a visitor's browser.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crocoblock","jetformbuilder","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin plugins list, or in the plugin's main file header.\n- Compare the version against the range in the NVD entry (through `3.6.8`).","fix":"- JetFormBuilder: unknown (sources do not name a fixed version)","status":"open","published_at":"2026-11-07T13:16:37+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","triaged_at":"2026-11-07T13:49:26+00:00","updated_at":"2026-11-07T13:49:26+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T13:49:26Z","model":"claude-haiku-5-5","output":{"fix":"- JetFormBuilder: unknown (sources do not name a fixed version)","reach":"internet","title":"JetFormBuilder: basic XSS lets script injection through web page forms","impact":"medium","summary":"JetFormBuilder, a WordPress form plugin from Crocoblock, fails to neutralize script-related HTML tags in some pages. An attacker can inject code that runs in a visitor's browser.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","jetformbuilder","crocoblock"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Script runs in visitors' browsers on the affected site","analyst_note":"Check the NVD entry and Crocoblock's vendor notes for the fixed version and whether authentication or a specific form setting is required.","how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin plugins list, or in the plugin's main file header.\n- Compare the version against the range in the NVD entry (through `3.6.8`).","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running JetFormBuilder up to and including `3.6.8` are in the stated range. The sources do not say which input paths or settings are needed, so unknown. Sites without the plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000686,"input_tokens":4230,"output_tokens":525,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123483':13A,16A '-2026':12A,15A '3.6.8':79C 'affect':74C 'allow':70C 'attack':40B 'basic':2A,63C 'browser':50B 'code':43B,71C 'crocoblock':17B,27B,67C 'cve':11A,14A 'fail':28B 'form':10A,24B 'html':34B,57C 'improp':51C 'inject':6A,42B 'injection.this':72C 'issu':73C 'jetformbuild':1A,18B,21B,68C,69C,75C 'let':4A 'n/a':77C 'neutral':30B,52C 'packag':19B 'page':9A,38B,62C 'plugin':25B 'relat':33B,56C 'run':45B 'script':5A,32B,55C 'script-rel':31B,54C 'tag':35B,58C 'visitor':48B 'vulner':65C 'web':8A,61C 'wordpress':20B,23B 'xss':3A,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running JetFormBuilder up to and including `3.6.8` are in the stated range. The sources do not say which input paths or settings are needed, so unknown. Sites without the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crocoblock","jetformbuilder","medium","package","wordpress"],"campaign_type":null,"search_a":"'-123483':13A,16A '-2026':12A,15A 'basic':2A 'cve':11A,14A 'form':10A 'inject':6A 'jetformbuild':1A 'let':4A 'page':9A 'script':5A 'web':8A 'xss':3A","search_b":"'attack':40B 'browser':50B 'code':43B 'crocoblock':17B,27B 'fail':28B 'form':24B 'html':34B 'inject':42B 'jetformbuild':18B,21B 'neutral':30B 'packag':19B 'page':38B 'plugin':25B 'relat':33B 'run':45B 'script':32B 'script-rel':31B 'tag':35B 'visitor':48B 'wordpress':20B,23B","search_c":"'3.6.8':79C 'affect':74C 'allow':70C 'basic':63C 'code':71C 'crocoblock':67C 'html':57C 'improp':51C 'injection.this':72C 'issu':73C 'jetformbuild':68C,69C,75C 'n/a':77C 'neutral':52C 'page':62C 'relat':56C 'script':55C 'script-rel':54C 'tag':58C 'vulner':65C 'web':61C 'xss':64C","first_public_at":"2026-11-07T13:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123483","severity":null,"published_at":"2026-11-07T13:16:37+00:00","modified_at":"2026-11-07T13:16:37+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","fetched_at":"2026-11-07T13:47:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}