CVE-2026-19861 JetFormBuilder CVE debrief

Who should care

Defenders responsible for WordPress installations using the JetFormBuilder plugin, particularly those sending email notifications, should assess exposure and prioritize verification and updates.

Why it matters

CVE-2026-19861 allows unauthenticated HTML injection in email notifications sent by the JetFormBuilder plugin, potentially impacting email recipients. Defenders should verify and update the plugin, monitor email notifications, and review email notification configurations to prevent potential HTML injection attempts.

• Potential HTML injection in email notifications
• Possible impact on email recipients
• Verification of plugin version and email notification configurations required

Technical summary

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. This vulnerability can lead to potential HTML injection in email notifications, impacting email recipients. Defenders should verify and update the JetFormBuilder plugin to version 3.6.5.2 or later, and monitor email notifications for potential HTML injection attempts. The vulnerability is related to improper sanitization of user input in the plugin's email notification functionality, which can be exploited by unauthenticated users to inject arbitrary HTML code into email notifications sent to administrators and other recipients. The impact of this vulnerability depends on the recipient's email client and configuration, but it can potentially lead to phishing attacks or other malicious activities. Defenders should review and update email notification configurations to prevent potential HTML injection attempts and ensure that the plugin is updated to the latest version. Additionally, defenders should monitor email notifications for potential HTML injection attempts and review email notification configurations to prevent potential HTML injection. The CVE record and NVD vulnerability detail page provide information on the vulnerability, but the scope of affected versions and potential impact require further verification by defenders. The vulnerability is considered medium severity, with a CVSS score of 4.7, and defenders should prioritize verifying and updating the plugin to prevent potential exploitation. Defenders should also consider implementing compensating controls, such as monitoring email notifications for suspicious activity, and reviewing email notification configurations to prevent potential HTML injection attempts. The JetFormBuilder plugin is widely used in WordPress installations, and defenders should assess their exposure to this vulnerability and prioritize verification and updates accordingly. The vulnerability can be exploited by an

Defensive priority

Defenders should prioritize verifying and updating the JetFormBuilder plugin to version 3.6.5.2 or later, and monitor email notifications for potential HTML injection attempts.

Recommended defensive actions

• Verify and update the JetFormBuilder plugin to version 3.6.5.2 or later
• Monitor email notifications for potential HTML injection attempts
• Review and update email notification configurations to prevent potential HTML injection
• Assess exposure of WordPress installations using the JetFormBuilder plugin
• Implement compensating controls, such as monitoring email notifications for suspicious activity
• Review email notification configurations to prevent potential HTML injection attempts
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, but the scope of affected versions and potential impact require further verification by defenders. Defenders should verify plugin version, review email notification configurations, and monitor for suspicious activity. The JetFormBuilder plugin is widely used in WordPress installations, and defenders should assess their exposure to this vulnerability and prioritize verification and updates accordingly. Additionally, defenders should consider implementing compensating controls, such as monitoring email notifications for suspicious activity, and reviewing email notification configurations to prevent potential HTML injection attempts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.