Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions. (CVE-2026-84817)

CVE-2026-84817 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting JetFormBuilder versions up to 3.6.5.1. The flaw allows attackers to inject malicious scripts that can execute in the context of users' browsers, leading to potential data theft, session hijacking, or other malicious actions. The CVSS v3.1 score is 7.1, indicating a high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to the execution of arbitrary scripts in users' browsers without authentication, potentially resulting in data exposure, session hijacking, or disruption of service. The vulnerability affects confidentiality, integrity, and availability of the affected system components.

No patch or official fix information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying web application firewalls or input validation controls to mitigate exploitation risk.