CVE-2026-103912

Name of the Vulnerable Software and Affected Versions JetFormBuilder versions prior to 3.6.7

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected DOM-Based Cross-Site Scripting. This occurs when a user is tricked into clicking a malicious link, allowing the execution of arbitrary web scripts. The issue is exploitable on pages containing a form with a text field configured with a query var Dynamic Preset and a data-jfb-macro or JFB FIELD:: macro reference targeting that field. The attack is carried out via the <attacker-chosen query var name matching the preset's query var setting> parameter.

Recommendations Update JetFormBuilder to version 3.6.7 or later.