{"id":"CVE-2026-123860","kind":"vulnerability","aliases":["CVE-2026-123860"],"related":[],"title":"JetFormBuilder WordPress plugin: stored XSS through form pages up to 3.6.8","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.","summary":"JetFormBuilder, a WordPress form plugin from Crocoblock, fails to neutralize script-related HTML tags in a web page, which is a basic cross-site scripting flaw. An attacker can inject script that runs in a visitor's or administrator's browser.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["crocoblock","jetformbuilder","runtime","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/jetformbuilder/`.\n- Compare the installed version against the affected range (3.6.8 and earlier).","fix":null,"status":"open","published_at":"2026-11-07T13:16:37+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","triaged_at":"2026-11-07T13:49:25+00:00","updated_at":"2026-11-07T13:49:25+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-07T13:49:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"JetFormBuilder WordPress plugin: stored XSS through form pages up to 3.6.8","impact":"medium","summary":"JetFormBuilder, a WordPress form plugin from Crocoblock, fails to neutralize script-related HTML tags in a web page, which is a basic cross-site scripting flaw. An attacker can inject script that runs in a visitor's or administrator's browser.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","jetformbuilder","crocoblock"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"script runs in visitors' browsers and admin sessions","analyst_note":"Confirm the fixed version and whether the injection needs authentication; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-123860 and the Crocoblock changelog.","how_to_check":"- Check the installed JetFormBuilder plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/jetformbuilder/`.\n- Compare the installed version against the affected range (3.6.8 and earlier).","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the JetFormBuilder plugin from Crocoblock at version 3.6.8 or earlier, typically WordPress sites with Elementor or Gutenberg forms. The sources do not say whether unauthenticated visitors can trigger the injection, so assume any site with public forms is in scope until checked.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000728,"input_tokens":4230,"output_tokens":610,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123860':14A,17A '-2026':13A,16A '3.6.8':11A,93C 'administr':62B 'affect':88C 'allow':84C 'attack':51B 'basic':44B,77C 'browser':64B 'code':85C 'crocoblock':18B,28B,81C 'cross':46B 'cross-sit':45B 'cve':12A,15A 'fail':29B 'flaw':49B 'form':7A,25B 'html':35B,71C 'improp':65C 'inject':53B 'injection.this':86C 'issu':87C 'jetformbuild':1A,19B,22B,82C,83C,89C 'n/a':91C 'neutral':31B,66C 'page':8A,40B,76C 'plugin':3A,26B 'relat':34B,70C 'run':56B 'runtim':20B 'script':33B,48B,54B,69C 'script-rel':32B,68C 'site':47B 'store':4A 'tag':36B,72C 'visitor':59B 'vulner':79C 'web':39B,75C 'wordpress':2A,21B,24B 'xss':5A,78C","nicknames":[],"mitigations":[],"who_affected":"Sites running the JetFormBuilder plugin from Crocoblock at version 3.6.8 or earlier, typically WordPress sites with Elementor or Gutenberg forms. The sources do not say whether unauthenticated visitors can trigger the injection, so assume any site with public forms is in scope until checked.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["crocoblock","jetformbuilder","medium","runtime","wordpress"],"campaign_type":null,"search_a":"'-123860':14A,17A '-2026':13A,16A '3.6.8':11A 'cve':12A,15A 'form':7A 'jetformbuild':1A 'page':8A 'plugin':3A 'store':4A 'wordpress':2A 'xss':5A","search_b":"'administr':62B 'attack':51B 'basic':44B 'browser':64B 'crocoblock':18B,28B 'cross':46B 'cross-sit':45B 'fail':29B 'flaw':49B 'form':25B 'html':35B 'inject':53B 'jetformbuild':19B,22B 'neutral':31B 'page':40B 'plugin':26B 'relat':34B 'run':56B 'runtim':20B 'script':33B,48B,54B 'script-rel':32B 'site':47B 'tag':36B 'visitor':59B 'web':39B 'wordpress':21B,24B","search_c":"'3.6.8':93C 'affect':88C 'allow':84C 'basic':77C 'code':85C 'crocoblock':81C 'html':71C 'improp':65C 'injection.this':86C 'issu':87C 'jetformbuild':82C,83C,89C 'n/a':91C 'neutral':66C 'page':76C 'relat':70C 'script':69C 'script-rel':68C 'tag':72C 'vulner':79C 'web':75C 'xss':78C","first_public_at":"2026-11-07T13:16:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123860","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123860","severity":null,"published_at":"2026-11-07T13:16:37+00:00","modified_at":"2026-11-07T13:16:37+00:00","first_seen_at":"2026-11-07T13:47:26+00:00","fetched_at":"2026-11-07T13:47:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}