{"id":"CVE-2026-123484","kind":"vulnerability","aliases":["CVE-2026-123484"],"related":[],"title":"JetFormBuilder WordPress plugin: DOM-based XSS lets attackers run scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.","summary":"JetFormBuilder, a form builder plugin from Crocoblock, has a DOM-based cross-site scripting flaw in versions up to and including 3.6.8. An attacker can make a visitor's browser run script that the page did not intend to run.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"JetFormBuilder","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["crocoblock","jetformbuilder","other","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin plugin list, or the `Version` header in its main plugin file","fix":"- Versions above `3.6.8` are reported as affected through `3.6.8`; the fixed version is unknown from the sources","status":"open","published_at":"2026-11-09T10:17:08+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","triaged_at":"2026-11-09T10:26:11+00:00","updated_at":"2026-11-09T10:26:11+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T10:26:11Z","model":"claude-haiku-5-5","output":{"fix":"- Versions above `3.6.8` are reported as affected through `3.6.8`; the fixed version is unknown from the sources","reach":"internet","title":"JetFormBuilder WordPress plugin: DOM-based XSS lets attackers run scripts","impact":"medium","summary":"JetFormBuilder, a form builder plugin from Crocoblock, has a DOM-based cross-site scripting flaw in versions up to and including 3.6.8. An attacker can make a visitor's browser run script that the page did not intend to run.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","jetformbuilder","crocoblock"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers on the affected site","analyst_note":"Confirm the fixed version and the exact vulnerable input path from the vendor advisory or NVD entry.","how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin plugin list, or the `Version` header in its main plugin file\n- unknown","plain_action":"","product_name":"JetFormBuilder","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Websites running the JetFormBuilder plugin up to version 3.6.8 may be exposed, where form pages render attacker-influenced input in the DOM. Sites without this plugin, or running a newer version, are not affected. Whether a specific form path is exploitable is unknown from the sources.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000752,"input_tokens":4555,"output_tokens":593,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123484':14A,17A '-2026':13A,16A '3.6.8':46B,93C 'affect':88C 'allow':82C 'attack':9A,48B 'base':6A,34B,85C 'browser':54B 'builder':26B 'crocoblock':19B,29B,79C 'cross':36B,74C 'cross-sit':35B,73C 'cve':12A,15A 'dom':5A,33B,84C 'dom-bas':4A,32B,83C 'flaw':39B 'form':25B 'generat':72C 'improp':65C 'includ':45B 'input':68C 'intend':62B 'issu':87C 'jetformbuild':1A,20B,23B,80C,81C,89C 'jetformbuilder':18A 'let':8A 'make':50B 'n/a':91C 'neutral':66C 'page':59B,71C 'plugin':3A,27B 'run':10A,55B,64B 'script':11A,38B,56B,76C 'site':37B,75C 'version':41B 'visitor':52B 'vulner':77C 'web':70C 'wordpress':2A,22B 'xss':7A 'xss.this':86C","nicknames":[],"mitigations":[],"who_affected":"Websites running the JetFormBuilder plugin up to version 3.6.8 may be exposed, where form pages render attacker-influenced input in the DOM. Sites without this plugin, or running a newer version, are not affected. Whether a specific form path is exploitable is unknown from the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["jetformbuilder"],"ptokens":["jetformbuilder"],"labels":["crocoblock","high","jetformbuilder","other","vendor","wordpress"],"campaign_type":null,"search_a":"'-123484':14A,17A '-2026':13A,16A 'attack':9A 'base':6A 'cve':12A,15A 'dom':5A 'dom-bas':4A 'jetformbuild':1A 'jetformbuilder':18A 'let':8A 'plugin':3A 'run':10A 'script':11A 'wordpress':2A 'xss':7A","search_b":"'3.6.8':46B 'attack':48B 'base':34B 'browser':54B 'builder':26B 'crocoblock':19B,29B 'cross':36B 'cross-sit':35B 'dom':33B 'dom-bas':32B 'flaw':39B 'form':25B 'includ':45B 'intend':62B 'jetformbuild':20B,23B 'make':50B 'page':59B 'plugin':27B 'run':55B,64B 'script':38B,56B 'site':37B 'version':41B 'visitor':52B 'wordpress':22B","search_c":"'3.6.8':93C 'affect':88C 'allow':82C 'base':85C 'crocoblock':79C 'cross':74C 'cross-sit':73C 'dom':84C 'dom-bas':83C 'generat':72C 'improp':65C 'input':68C 'issu':87C 'jetformbuild':80C,81C,89C 'n/a':91C 'neutral':66C 'page':71C 'script':76C 'site':75C 'vulner':77C 'web':70C 'xss.this':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123484","severity":null,"published_at":"2026-11-09T10:17:08+00:00","modified_at":"2026-11-09T10:17:08+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","fetched_at":"2026-11-09T10:25:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}