CVE-2026-119479

Name of the Vulnerable Software and Affected Versions JetFormBuilder versions prior to 3.6.7.2

Description Improper neutralization of script-related HTML tags allows for code injection. The issue stems from missing tokenization of user-supplied macro values before the do shortcode() function is executed, which allows submitted field values to be interpreted as shortcode syntax. Unauthenticated attackers can inject arbitrary shortcodes through form field values that are executed on the server when processed by the Send Email, Call Webhook, Redirect To Page, or Media field settings.

Recommendations Update to a version newer than 3.6.7.1.