CVE-2026-111317

Description

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<any form field name — e.g. 'payload'>' parameter in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the targeted form to have both the Save Form Record action enabled and a form-level Form Record preset configured; the stored payload only executes when a privileged user visits the front-end form page with the preset's record query variable set to the attacker's submitted record ID.

Overview

State: PUBLISHED
Assigner (CNA): Wordfence
CVSS severity: HIGH
CVSS score: 7.2 / 10
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Effective score: 7.2 / 10 HIGH source: CNA overview
CWE(s): CWE-79
Reserved: 2026-10-15
Published: 2026-11-07 11:26 UTC
Last updated: 2026-11-07 18:05 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/111xxx/CVE-2026-111317.json
Linked Threat: CVE-2026-111317 — JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source

Affected products (1)

Vendor	Product	Versions	Platforms
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	`0` (affected)	—

Vendor references (7)

References embedded in the original CVE record by the assigning CNA.

MITRE references (7) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (0)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

No web references attached yet.

Indicators (1)

IOCs linked to the auto-promoted Threat row.

Type	Value	VirusTotal	Attached
cve	`CVE-2026-111317`	no local data	2026-11-07 00:24 UTC

Remediations (9)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

CVE-2026-113117: Google Chrome Out-of-bounds Read | CVETodo

web:cvetodo.com

CVE - 2026 -113117 is a CVSS 8.8 Out-of-bounds Read vulnerability in Google Chrome. Includes technical details, affected versions, and mitigation steps.

2026-11-07 00:24 UTC
CVE-2026-113317 — HIGH severity vulnerability | IsItPatched

web:isitpatched.com

CVE - 2026 -113317: HIGH severity (CVSS 8.8). Affected products, impact, and what to do.

2026-11-07 00:24 UTC
CVE-2026-113117 - vulnerability database | Vulners.com

web:vulners.com

Google Chrome on Mac prior to version 156..8078.47 is vulnerable to arbitrary code execution within the sandbox due to improper input validation in the ANGLE component. A remote attacker can trigger this vulnerability by hosting a crafted HTML pa...

2026-11-07 00:24 UTC
What Is CVE Remediation in 2026? - aikido.dev

web:www.aikido.dev

CVE remediation is fixing known flaws in the software you run. Why upgrading often fails, what remediation actually involves, and how backporting fixes it.

2026-11-07 00:24 UTC
Chrome 157 fixes 213 security issues, including 7 critical flaws

web:www.malwarebytes.com

On November 3, Google issued Chrome 157 to the stable channel for Windows, Mac and Linux. The update is rolling out over the coming days and weeks. Most users are on Chrome's Stable channel. The desktop update brings Chrome to versions 157..8103.38/.39 for Windows and Mac and 157..8103.38 for Linux. It includes 213 security fixes, including seven vulnerabilities rated Critical by Google ...

2026-11-07 00:24 UTC
Oracle Critical Patch Update Advisory - July 2026

web:www.oracle.com

This Critical Patch Update contains 1448 new security patches across the product families listed below. Please note that a My Oracle Support (MOS) note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at July 2026 Critical Patch Update: Executive Summary and Analysis.

2026-11-07 00:24 UTC
Oracle Critical Security Patch Update Advisory - September 2026

web:www.oracle.com

Prior Critical Patch Update and Critical Security Patch Update advisories should be reviewed for information regarding earlier published security patches. Refer to Critical Patch Updates, Critical Security Patch Updates, Security Alerts and Bulletins for information about Oracle Security advisories.

2026-11-07 00:24 UTC
Google Chrome Vulnerability: CVE-2026-113317 - Rapid7

web:www.rapid7.com

Google Chrome Vulnerability: CVE - 2026 -113317. View severity, references, and remediation details from Rapid7.

2026-11-07 00:24 UTC
Wordfence remediation: JetFormBuilder — Dynamic Blocks Form Builder

Wordfence

Update to version 3.6.7.1, or a newer patched version

2026-11-07 00:24 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-111317.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-111317",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-07T17:59:16.514055Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-07T18:05:59.534Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Mohamed Amgad Khater (mamgad)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<any form field name \u2014 e.g. 'payload'>' parameter in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the targeted form to have both the Save Form Record action enabled and a form-level Form Record preset configured; the stored payload only executes when a privileged user visits the front-end form page with the preset's record query variable set to the attacker's submitted record ID."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-07T11:26:34.962Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ce95c4a1-0873-4178-a63a-ca9ffdb29ed7?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/includes/blocks/render/base.php#L277"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/modules/form-record/controller.php#L204"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/includes/presets/sources/preset-source-form-record.php#L99"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/includes/blocks/types/base.php#L356"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.7/includes/form-handler.php#L85"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=&old=3758108%40jetformbuilder&new=3758108%40jetformbuilder"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-15T20:36:29.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-11-06T22:46:18.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-111317",
    "datePublished": "2026-11-07T11:26:34.962Z",
    "dateReserved": "2026-10-15T20:21:14.387Z",
    "dateUpdated": "2026-11-07T18:05:59.534Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}