CVE-2026-97342: JetFormBuilder WordPress XSS Vulnerability

CVE-2026-97342 Overview

CVE-2026-97342 is a stored Cross-Site Scripting (XSS) vulnerability in the JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress. All versions up to and including 3.6.5.4 are affected. The flaw [CWE-79] stems from insufficient input sanitization and output escaping in the choice post meta handling of the Insert/Update Post action. Unauthenticated attackers can submit crafted payloads through the wp_ajax_nopriv_jet_form_builder_submit endpoint. The injected script is stored verbatim in post meta and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option attributes and label content.

Critical Impact
Unauthenticated attackers can persist arbitrary JavaScript in WordPress post meta that executes in the browser of any visitor rendering an affected page, enabling session hijacking, administrative action forgery, and site defacement.

Affected Products

JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress
All versions up to and including 3.6.5.4
WordPress sites using the Select Field block with the get_from_db option generator

Discovery Timeline

2026-10-02 - CVE-2026-97342 published to NVD
2026-10-03 - Last updated in NVD database

Technical Details for CVE-2026-97342

Vulnerability Analysis

The vulnerability chains three plugin components. First, the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint in includes/form-handler.php accepts submission data without rejecting markup in field keys. Second, the Insert/Update Post action persists submitted values into post meta through modules/actions-v2/insert-post/properties/post-meta-property.php, storing the attacker-controlled payload verbatim. Third, the Select Field block template at modules/option-field/blocks/select/block-template.php reads those meta values through the get_from_db generator and emits them into <option value="..."> attributes and label text without escaping. Any visitor to a page containing the affected Select Field triggers execution of the stored script in their browser.

Root Cause

The root cause is missing sanitization of array keys inside the recursive sanitization routine in includes/classes/tools.php. Keys that contain HTML markup bypass escaping because the plugin only sanitizes values, not keys. Downstream rendering trusts those keys when generating option attributes, producing a stored XSS sink.

Attack Vector

An unauthenticated attacker sends a POST request to the wp_ajax_nopriv_jet_form_builder_submit AJAX endpoint. The payload embeds JavaScript inside a choice field key handled by the Insert/Update Post action. The payload is stored in post meta. When any user—including administrators—loads a page that renders the Select Field block with get_from_db, the browser executes the injected script.

php

// Vendor patch in includes/classes/tools.php sanitizing array keys
$result = array();

foreach ( $source as $key => $value ) {
    $key = is_string( $key ) ? self::sanitize_array_key( $key ) : $key;

    // When sanitized keys collide, keep the first value.
    if ( array_key_exists( $key, $result ) ) {
        continue;
    }

    $result[ $key ] = self::sanitize_recursive( $value );
}

return $result;

/**
 * Strips tags from an array key. Keys without tags stay unchanged,
 * preserving whitespace and percent-encoded sequences in field names.
 */
public static function sanitize_array_key( string $key ): string {
    return false === strpos( $key, '<' ) ? $key : wp_strip_all_tags( $key, false );
}

Source: GitHub Commit 534c2ce

Detection Methods for CVE-2026-97342

Indicators of Compromise

POST requests to admin-ajax.php with action=jet_form_builder_submit containing <script>, onerror=, or event-handler strings in field names.
Post meta records containing raw HTML tags or JavaScript inside keys associated with the Insert/Update Post action.
Unexpected <script> or event-handler attributes rendered inside <option> tags on front-end pages that use JetFormBuilder Select Field blocks.

Detection Strategies

Query the wp_postmeta table for meta keys or values containing <script, javascript:, or onerror= substrings linked to posts created through JetFormBuilder.
Inspect web server access logs for unauthenticated POSTs to wp_ajax_nopriv_jet_form_builder_submit from a single source with abnormal payload sizes.
Monitor WordPress audit logs for Insert/Update Post actions triggered by anonymous submissions where field data contains encoded or raw HTML.

Monitoring Recommendations

Enable a web application firewall rule that blocks HTML tags inside form field keys submitted to JetFormBuilder endpoints.
Alert on first-time rendering of <option> elements containing script content on public pages.
Review the Wordfence advisory (Wordfence Vulnerability ID #84857045) for signature-based identification updates.

How to Mitigate CVE-2026-97342

Immediate Actions Required

Update JetFormBuilder to the version containing commit 534c2ce or later as released by Crocoblock.
Audit all forms using the Insert/Update Post action and the Select Field block with the get_from_db option generator.
Scan wp_postmeta for existing malicious content and purge any entries containing script payloads.

Patch Information

The vendor patch introduces a sanitize_array_key helper in includes/classes/tools.php that strips tags from array keys during recursive sanitization. The fix is documented in GitHub Commit 534c2ce. Site administrators must upgrade past version 3.6.5.4 to receive the fix.

Workarounds

Disable the JetFormBuilder plugin until the patched version is applied.
Remove or unpublish forms that use the Insert/Update Post action with the Select Field block.
Apply a WAF rule to reject requests to wp_ajax_nopriv_jet_form_builder_submit whose field keys contain <, >, or javascript:.

bash

# Example WAF ModSecurity rule blocking HTML in JetFormBuilder field keys
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,id:1097342,phase:2,deny,status:403,msg:'JetFormBuilder XSS attempt CVE-2026-97342'"
  SecRule ARGS_NAMES "@rx <|javascript:|on[a-z]+=" \
    "chain"
  SecRule ARGS:action "@streq jet_form_builder_submit"