CVE-2026-121977

Name of the Vulnerable Software and Affected Versions JetFormBuilder — Dynamic Blocks Form Builder versions prior to 3.6.9

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts through the note parameter, which is a form field whose value is written to post meta note. These scripts execute when a user accesses the affected page. Exploitation requires a privileged user with the edit others posts capability to visit a specific form URL containing a post ID created by the attacker, typically delivered via a phishing link.

Recommendations Update JetFormBuilder — Dynamic Blocks Form Builder to version 3.6.9 or later.