CVE-2026-19861: CWE-79 Cross-Site Scripting (XSS) in JetFormBuilder — Dynamic Blocks Form Builder

The JetFormBuilder WordPress plugin versions prior to 3.6.5.2 do not properly sanitize and escape form field values included in HTML notification emails. This flaw allows unauthenticated attackers to inject arbitrary HTML content into these emails. While script execution depends on the mail client used by the recipient, the injected HTML markup is always rendered, potentially leading to information disclosure or other impacts associated with XSS in email contexts.

An unauthenticated attacker can inject arbitrary HTML into notification emails sent by the plugin. The impact depends on the recipient's mail client rendering the injected markup. This could lead to limited confidentiality and integrity impacts (as indicated by the CVSS vector), but no direct availability impact. The CVSS score of 4.7 reflects a medium severity level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting or monitoring form inputs and reviewing email client security settings to mitigate potential risks from malicious HTML content in emails.