CVE-2026-121977

Description

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note (form field whose value is written to post meta `note`)' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a privileged user with the edit_others_posts capability to visit a form URL containing the attacker-created post ID, a delivery step the attacker controls via a crafted phishing link.

Overview

State: PUBLISHED
Assigner (CNA): Wordfence
CVSS severity: MEDIUM
CVSS score: 5.4 / 10
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Effective score: 5.4 / 10 MEDIUM source: CNA overview
CWE(s): CWE-79
Reserved: 2026-11-04
Published: 2026-11-07 11:26 UTC
Last updated: 2026-11-07 18:05 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121977.json

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-119166

EUVD enrichment is queued; refresh the page in a few seconds.

Affected products (1)

Vendor	Product	Versions	Platforms
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	`0` (affected)	—

Vendor references (6)

References embedded in the original CVE record by the assigning CNA.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Remediations (10)

US Cyber Agency Says a WordPress Flaw Fixed in October Is Now Being ...

web:allatra.media

A fix for the flaw, CVE - 2026 -119977, has been available since Oct. 28, 2026 . For anyone who runs a WordPress site, the detail to act on is the version number. The CVE record lists versions 4.7 through 7.1.3 as affected and puts the fix in WordPress 7.1.4. Neither CISA's alert nor that record gives any figure for how many sites have been attacked.

2026-11-08 11:35 UTC
CVE-2026-119977 - Vulnerability Details - OpenCVE

web:app.opencve.io

Remediation No solution or workaround provided in the CVE record. OpenCVE Recommended Actions Upgrade WordPress to version 7.1.4 or later to remove the vulnerable upgrade mechanism.

2026-11-08 11:35 UTC
WordPress CVE-2026-119977: Patch, Check And Detect

web:cipherssecurity.com

WordPress CVE - 2026 -119977 is an exploited core RCE that opens during updates, now on CISA KEV. Fixed versions for every branch, checks and a Sigma rule.

2026-11-08 11:35 UTC
Hackers Tried to Break Into WordPress Sites 240,000 Times After a ...

web:coincentral.com

A WordPress update flaw drew more than 240,000 blocked attack attempts, and CISA ordered federal agencies to patch it by November 6.

2026-11-08 11:35 UTC
CVE-2026-119977 Exploitation Attempts Observed - Previdian

web:previdian.com

CVE - 2026 -119977 exploitation intelligence for WordPress: confirmed exploitation attempts, Previdian sensor telemetry, CISA KEV status, observed attempts, timeline, and PoCs.

2026-11-08 11:35 UTC
WordPress CVE-2026-119977: CISA Sets Nov. 6 Deadline [2026]

web:tech-insider.org

CISA added WordPress Core CVE - 2026 -119977 to KEV on Nov. 3. Federal agencies must patch by Nov. 6. Here is what 7.1.4 fixes and how to check.

2026-11-08 11:35 UTC
CISA Flags Actively Exploited WordPress Core RCE Flaw, Patch to 7.1.4

web:thebackroomtech.com

The short answer to "am I at risk?" is this. If you run a self-hosted WordPress site that is not on the latest security release, treat this as an emergency patch , not routine maintenance. WordPress.org's 7.1.4 release notes list the fix as "a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window" and say the security fixes are ...

2026-11-08 11:35 UTC
CISA Confirms Exploitation of WordPress Core Upgrade Flaw

web:www.esecurityplanet.com

CISA confirms exploitation of a WordPress Core upgrade flaw. Learn which versions contain fixes and what administrators should check for signs of compromise.

2026-11-08 11:35 UTC
CISA confirms WordPress security flaw under attack: What website owners ...

web:www.pcquest.com

CISA confirms attacks on a WordPress Core flaw that could expose servers during updates. Learn which versions are affected and what administrators should check.

2026-11-08 11:35 UTC
CVE-2026-119977 | Tenable®

web:www.tenable.com

WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.

2026-11-08 11:35 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-121977.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121977",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:58:49.168541Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:59.085Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "UKO"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note (form field whose value is written to post meta `note`)' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a privileged user with the edit_others_posts capability to visit a form URL containing the attacker-created post ID, a delivery step the attacker controls via a crafted phishing link."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:36.079Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/f586a89a-7d1f-48ef-bbf6-0c78154bccbc?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.8/includes/blocks/dynamic-value.php#L88"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.8/assets/build/frontend/dynamic.value.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.8/includes/presets/sources/preset-source-post.php#L83"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.8/includes/functions.php#L123"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3788241/jetformbuilder/trunk/includes/blocks/dynamic-value.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-11-04T13:28:04.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T21:49:06.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-121977",
    "datePublished": "2026-11-07T11:26:36.079Z",
    "dateReserved": "2026-11-04T13:12:10.363Z",
    "dateUpdated": "2026-11-07T18:05:59.085Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}