VULNERABILITY INTELLIGENCE
CVE-2026-19861
CVSS score4.7 MEDIUM
EPSS probability0.22%
CISA KEVNot currently listed
Published2026-09-05
Last modified2026-09-08
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. Whether injected script executes depends on the recipient's mail client, but the injected markup is rendered regardless.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79