CVE-2026-119183

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<form field mapped to a post meta key, e.g. lst_cost>' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to have configured a public Insert Post form writing to a post meta key and a Calculated Field whose formula references that key via the %META::key% macro, after which a single unauthenticated POST is sufficient to persist the payload.

• CWE-79

• https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/includes/blocks/render/calculated-field-render.php#L56
• https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/modules/actions-v2/insert-post/insert-post-action.php#L53
• https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/modules/actions-v2/insert-post/properties/post-meta-property.php#L157
• https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/templates/fields/calculated-field.php#L31
• https://plugins.trac.wordpress.org/changeset/3788241/jetformbuilder/trunk/includes/blocks/render/calculated-field-render.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/3b3d2e0d-ce2a-48cd-a36f-92979335fd71?source=cve

Published

Nov 7, 2026

Last Modified

Nov 7, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119171The Advanced Product Fields (Product Addons) for WooCommerce…5.3
• CVE-2026-119175The Flying Images: Optimize and Lazy Load Images for Faster …7.2
• CVE-2026-119176The CP Multi View Events Calendar plugin for WordPress is vu…6.4
• CVE-2026-119178The Smart Cookie Kit plugin for WordPress is vulnerable to S…5.4
• CVE-2026-119179A flaw in the connection management layer of the MongoDB Nod…7
• CVE-2026-11918IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge…6.5
• CVE-2026-119186Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-119187Forge (also called node-forge) is a native implementation of…7.5
• CVE-2026-119188Forge (also called node-forge) is a native implementation of…7.5
• CVE-2026-119189Forge (also called node-forge) is a native implementation of…5.9
• CVE-2026-119190Forge (also called node-forge) is a native implementation of…7.4
• CVE-2026-119191Forge (also called node-forge) is a native implementation of…7.5