CVE-2026-97342

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-97342
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97342.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-97342
Published
2026-10-02T07:39:26Z
Modified
2026-10-04T02:46:44Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
Details

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content.

Database specific 
{
    "cna_assigner":  "Wordfence",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97342.json"
}
References

Affected packages

Git / github.com/crocoblock/jetformbuilder

Affected ranges

Type
GIT
Repo
https://github.com/crocoblock/jetformbuilder
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
534c2ce996408d1f9b5a9fba165348a7cd38bccc
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "last_affected":  "3.6.5.4"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.0.0-beta
3.2.0
3.3.1
3.3.2
3.3.3
3.3.3.1
3.4.0
3.4.1
3.4.2
3.4.3
3.4.4
3.4.5
3.4.5.1
3.4.5.2
3.5.0
3.5.1
3.5.1.1
3.5.1.2
3.6.0
3.6.0.1
3.6.1
3.6.1.1
3.6.2
3.6.2.1
3.6.2.2
3.6.3
3.6.5
3.6.5.1
3.6.5.2
3.6.5.3
3.6.5.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97342.json"