JetFormBuilder permits unauthenticated shortcode execution through form messages
JetFormBuilder before 3.6.5.2 renders attacker-controlled request data as form message content and expands shortcodes after escaping that content. An unauthenticated attacker can use a page displaying a form to execute any shortcode registered on the site, exposing data or invoking actions available through those shortcodes.
- Component
- JetFormBuilder
- Plugin slug
jetformbuilder- Affected
- < 3.6.5.2
- Safe version
3.6.5.2- Published
- Sep 06, 2026
This CVE was published Sep 06, 2026 and is one of 25 known issues for this plugin.
Update, patch or deactivate.
Update JetFormBuilder to 3.6.5.2 or later and review forms that render request-derived messages. If an immediate update is not possible, deactivate affected forms or the plugin according to the site's risk profile.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later shortcode-expansion pass rather than after it, so the escaping can be bypassed.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N