CVE-2026-92212: JetFormBuilder WordPress Plugin XSS Vulnerability

CVE-2026-92212 Overview

CVE-2026-92212 is a reflected Cross-Site Scripting (XSS) vulnerability in the JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress [CWE-79]. The flaw affects all plugin versions up to and including 3.6.5.3. It stems from insufficient input sanitization and output escaping of the jfb_xss URL query variable when consumed by a Calculated Field. Unauthenticated attackers can inject arbitrary web scripts that execute in a victim's browser after the victim clicks a crafted link. Exploitation requires a target page that hosts a form configured with both a URL Query Variable preset field and a Calculated Field referencing it, which are standard plugin features.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser session, enabling session theft, administrative action hijacking, and content tampering when a logged-in administrator clicks a malicious URL.

Affected Products

JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress
All versions up to and including 3.6.5.3
WordPress sites hosting forms that combine a URL Query Variable preset field with a referencing Calculated Field

Discovery Timeline

2026-09-25 - CVE CVE-2026-92212 published to NVD
2026-09-25 - Last updated in NVD database

Technical Details for CVE-2026-92212

Vulnerability Analysis

The vulnerability resides in the Calculated Field rendering path of JetFormBuilder. When a form uses a URL Query Variable preset to populate a field, the plugin reads attacker-controlled data from the query string parameter jfb_xss and passes it into the Calculated Field value without adequate sanitization or output escaping. The reflected value is then injected into the rendered page markup or evaluated by the frontend calculation logic in assets/build/frontend/main.js, allowing attacker-supplied content to break out of its intended context and execute as script in the victim's browser.

Because user interaction is required, exploitation relies on social engineering — a victim must click a crafted URL pointing to a vulnerable page. The scope change in the vector reflects that injected script executes in the context of the victim's authenticated session, which can be used to perform privileged actions against the WordPress site if the victim is an administrator.

Root Cause

The root cause is missing input validation on the jfb_xss URL query parameter and missing output escaping when the Calculated Field renders this value. The relevant code paths include includes/presets/sources/preset-source-query-var.php, includes/blocks/render/calculated-field-render.php, and templates/fields/calculated-field.php. User input flows from the query string through the preset source into the Calculated Field template and frontend calculation engine without being filtered through a WordPress escaping function such as esc_attr(), esc_html(), or wp_kses() appropriate to the output context.

Attack Vector

An unauthenticated remote attacker crafts a URL targeting a vulnerable WordPress page that hosts a form meeting the configuration preconditions. The attacker embeds a malicious payload in the jfb_xss query parameter and distributes the link via email, chat, or a third-party site. When a victim loads the URL, the plugin reflects the payload into the rendered page and the script executes in the victim's browser under the origin of the WordPress site. See the WordPress JetFormBuilder PHP Render source and the Wordfence Vulnerability Report for technical details.

No verified proof-of-concept code is published. The vulnerability mechanism is reflected XSS: the server returns attacker-controlled input in the HTTP response, and the browser interprets that input as executable script.

Detection Methods for CVE-2026-92212

Indicators of Compromise

HTTP requests to WordPress pages containing the query parameter jfb_xss with values that include angle brackets, script tags, javascript: URIs, or event handler attributes such as onerror= or onload=
Referrer logs showing external sites redirecting users to WordPress pages with suspicious jfb_xss payloads
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after visiting a URL containing jfb_xss
Creation of new administrator accounts or modification of plugin and theme files immediately after an administrator session interacts with a suspicious link

Detection Strategies

Inspect web server access logs for GET requests containing the jfb_xss parameter and apply pattern matching for common XSS payload fragments
Deploy a Web Application Firewall (WAF) rule that flags or blocks requests to pages hosting JetFormBuilder forms when the jfb_xss parameter contains HTML or JavaScript metacharacters
Compare installed JetFormBuilder plugin versions across WordPress fleets against the patched release to identify exposed sites

Monitoring Recommendations

Enable WordPress audit logging to capture administrator actions and correlate them with upstream HTTP referrers containing jfb_xss
Monitor browser-side Content Security Policy (CSP) violation reports originating from pages that embed JetFormBuilder forms
Alert on anomalous administrator-initiated REST API calls that follow navigation to URLs carrying the jfb_xss query parameter

How to Mitigate CVE-2026-92212

Immediate Actions Required

Update the JetFormBuilder plugin to the version published after 3.6.5.3 that includes the fix referenced in the WordPress JetFormBuilder Changeset
Audit all published forms for Calculated Fields that reference URL Query Variable preset fields and temporarily disable or reconfigure them until the plugin is patched
Rotate administrator session cookies and credentials if logs indicate that any administrator loaded a URL containing a suspicious jfb_xss value

Patch Information

The vendor committed a fix in changeset 3707612 for the JetFormBuilder plugin. Site operators should upgrade to the first released version that incorporates this changeset. Review the WordPress JetFormBuilder Changeset and the Wordfence Vulnerability Report for the exact fixed version.

Workarounds

Remove or reconfigure forms that combine a URL Query Variable preset with a Calculated Field until the plugin can be updated
Deploy a WAF rule that strips or blocks the jfb_xss query parameter from inbound requests to pages hosting JetFormBuilder forms
Enforce a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins to reduce the impact of reflected injection

bash

# Example WAF rule concept (ModSecurity-style) to block suspicious jfb_xss values
SecRule ARGS:jfb_xss "@rx (?i)(<script|javascript:|onerror=|onload=|<svg)" \
    "id:1092212,phase:2,deny,status:403,msg:'CVE-2026-92212 JetFormBuilder XSS attempt'"