CVE-2026-103912 Overview
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress contains a reflected DOM-based Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting all versions up to and including 3.6.6. The flaw stems from insufficient input sanitization and output escaping when a form field uses a query_var Dynamic Preset together with a data-jfb-macro or JFB_FIELD:: macro reference. Unauthenticated attackers can craft a URL that injects arbitrary JavaScript into the rendered page. Exploitation requires a victim to click a crafted link, which then triggers script execution in the victim's browser context.
Critical Impact
Successful exploitation enables attackers to execute arbitrary JavaScript in a victim's browser session, potentially leading to session hijacking, credential theft, or unauthorized actions performed as the victim.
Affected Products
- WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin, all versions through 3.6.6
- WordPress sites embedding a form with a text field using a query_var Dynamic Preset
- WordPress sites using data-jfb-macro or JFB_FIELD:: macro references targeting such fields
Discovery Timeline
- 2026-10-10 - CVE-2026-103912 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-103912
Vulnerability Analysis
The vulnerability resides in JetFormBuilder's client-side form processing logic, where query string parameters are consumed as preset values and injected into the DOM through macro references. Because the plugin does not sanitize input or escape output in this path, attacker-controlled query string content reaches a sink that executes JavaScript. The relevant logic can be traced through the plugin's preset-source-query-var.php and the compiled assets/build/frontend/main.js. The resulting XSS is reflected and DOM-based, meaning the payload is reflected via URL parameters and executed by client-side JavaScript rather than returned by the server in HTML.
Root Cause
The root cause is missing input sanitization in the query_var Dynamic Preset source and missing output escaping when the preset value is written into the DOM via data-jfb-macro or JFB_FIELD:: macro expansion. The preset reads an attacker-chosen query variable from the URL, then the macro consumer renders that value into the page without neutralizing HTML or script content.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker crafts a URL to a vulnerable page that embeds a form configured with a query_var preset and a matching macro field. The URL includes the attacker-controlled query parameter whose name matches the preset's query_var setting and whose value contains a JavaScript payload. When the victim clicks the link, the plugin's frontend script reads the parameter and injects the payload into the DOM, where the browser executes it. Exploitation complexity is elevated because the target page must have the specific preset and macro configuration enabled.
For source-level details, see the WordPress JetFormBuilder PHP Source and the WordPress JetFormBuilder JS File.
Detection Methods for CVE-2026-103912
Indicators of Compromise
- Inbound HTTP requests to pages hosting JetFormBuilder forms containing query string parameters with <script>, onerror=, javascript:, or encoded script fragments.
- Web server access logs showing unusual query parameter names that match configured query_var preset identifiers.
- Referrer headers from phishing domains leading users to pages that embed JetFormBuilder forms.
Detection Strategies
- Audit WordPress sites for installed JetFormBuilder versions at or below 3.6.6 and inventory forms configured with a query_var Dynamic Preset.
- Implement web application firewall (WAF) rules that flag query parameters containing HTML tags or JavaScript event handlers targeting pages with JetFormBuilder forms.
- Monitor browser-side telemetry or Content Security Policy (CSP) violation reports for script execution originating from URL-sourced content.
Monitoring Recommendations
- Enable CSP reporting on WordPress sites to capture inline script violations that may indicate exploitation attempts.
- Review user interaction patterns and traffic surges to pages embedding JetFormBuilder forms, particularly from external referrers.
- Correlate suspicious URL requests with downstream session anomalies such as unexpected authenticated actions following a click event.
How to Mitigate CVE-2026-103912
Immediate Actions Required
- Upgrade the JetFormBuilder plugin to a version later than 3.6.6 once released, applying the fix referenced in the WordPress JetFormBuilder Changeset.
- Audit all forms using query_var Dynamic Presets with data-jfb-macro or JFB_FIELD:: macro references and disable them until patched.
- Deploy a WAF rule set to block query strings containing script tags or JavaScript event handler patterns on pages hosting JetFormBuilder forms.
Patch Information
A fix has been committed in the plugin's trunk branch. Review the WordPress JetFormBuilder Changeset and the Wordfence Vulnerability Report for release details. WordPress administrators should update through the plugins dashboard as soon as a fixed release is published.
Workarounds
- Temporarily remove or reconfigure forms that pair a query_var Dynamic Preset with data-jfb-macro or JFB_FIELD:: macro references on the same field.
- Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
- Educate users to avoid clicking unsolicited links pointing to the WordPress site, particularly links carrying query parameters.
# Example strict CSP header to mitigate reflected DOM XSS
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
