CVE-2026-19861mediumCWE-79

CVE-2026-19861: medium-severity vulnerability in JetFormBuilder — Dynamic Blocks Form Builder

JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails

Published · Updated

Follow this CVE+ Monitor JetFormBuilder — Dynamic Blocks Form Builder

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 4.7epss 0.2%
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. Whether injected script executes depends on the recipient's mail client, but the injected markup is rendered regardless.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Unknown · JetFormBuilder — Dynamic Blocks Form Builder
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — JetFormBuilder — Dynamic Blocks Form Builder

In the same product, most dangerous first.

CVE-2026-19858HIGHJetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic PresetEPSS 0.4%CVE-2026-19860MEDIUMJetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation CallbackEPSS 0.4%