CVE-2026-84817

Overview

Summary

JetFormBuilder through 3.6.5.1 has an unauthenticated XSS vulnerability. Anthony Green's research traced untrusted media-field presets into HTML previews; the published CVE classifies the impact as stored XSS.

Vulnerability Classification

Security Impact

An attacker can place script-bearing content into an affected media preview without a WordPress account. A visitor who interacts with the preview can trigger script in the site's origin. The stored path can expose later viewers, including staff reviewing submissions. The published score is CVSS 3.1 High (7.1); the lab evidence described here establishes unsafe rendering and persistence, not a demonstrated site takeover.

Affected Products

JetFormBuilder WordPress plugin versions 3.6.5.1 and earlier. The CVE record lists unaffected as its default status for versions outside the stated range.

Component: Media field preset and preview rendering

Fixed version: 3.6.5.2 or later

Technical Details

The original 3.6.5.1 assessment found that the media preview renderer inserted preset URLs and filenames into quoted HTML attributes without escaping them for that context. Query-string presets and saved post metadata both reached this renderer. In the stored path, a submitted value containing quotes could survive input handling that only applied HTML filtering when it saw an angle bracket. A separate preset-read check treated an anonymous visitor and an authorless post as the same owner because both had ID zero. These conditions let an anonymous submission reach a later preview. The report documented reflected and stored paths through the same renderer; the public CVE identifies stored XSS.

This public record provides enough information to identify the vulnerability and its root cause without unnecessarily publishing weaponized exploit material.

Research method

How We Investigated

1. 1. Follow a field through every renderer

   The assessment compared the media preview with the hidden input holding the same value. The hidden input escaped its output, while the preview substituted the value directly into HTML. Following the value to each output location exposed a gap that checking only the form submission would miss.

2. 2. Separate reflection from persistence

   The report first compared a query-string preset with an empty-input control. It then used the built-in Insert/Update Post action and a post-meta preset to test a separate submit, save, and render sequence. Requests without cookies and a database check established that the value came from an anonymous submission and survived storage.

3. 3. Check what an ownership comparison means

   The stored record had no authenticated author. Comparing its author ID with the anonymous visitor's user ID produced equality, but did not establish ownership. The useful review question is whether the caller has a real authenticated identity before an ownership comparison can grant access.

Research evidence

Controlled Lab Validation

The original report used JetFormBuilder 3.6.5.1 in an isolated WordPress lab, with JetFormBuilder as the only active plugin. It configured media presets and frontend submit/edit forms using the plugin's built-in features.

The controls connect anonymous input, persistence, and unsafe output in the tested form configuration. These are observations from the original research report, not a fresh test of the patched release. The affected range and fixed version below come from the published CVE.

Attack Requirements

• The site must run an affected JetFormBuilder version and expose the relevant media-field preset configuration.
• The demonstrated stored path uses a public submission form that saves media values and a form that renders those values from post metadata.
• The attacker does not need a WordPress account.
• A victim must view and interact with the affected content; the published CVSS vector requires user interaction.

Remediation

• Inventory forms that accept media values or populate media fields from query strings and saved post metadata.
• After updating, verify in staging that malformed values remain inert in previews, including values saved before the update.
• For custom form code, validate media values and escape each HTML attribute or URL at output; input filtering alone is insufficient.
• Include anonymous visitors and authorless records in ownership regression checks.

Disclosure Timeline

1. August 18, 2026

   Report submitted

   Patchstack's public timeline records Anthony Green's report on this date.

2. September 7, 2026

   Patchstack advisory published

   Patchstack published its advisory and listed 3.6.5.2 as the patched version.

3. September 8, 2026

   CVE record published

   The CVE record credited Anthony Green of Greenhat Security through the Patchstack Bug Bounty Program.

Patchstack's advisory is dated September 7; the official CVE publication timestamp is September 8. The research narrative summarizes the original assessment, while version ranges, severity, and remediation follow the public record.

Researcher Credit

• Anthony Green [antnation] — Green Hat Security

Coordination and CVE Attribution

Anthony Green of Green Hat Security reported the finding through the Patchstack Bug Bounty Program. Patchstack coordinated disclosure and assigned the CVE ID.

Green Hat Security did not reserve or assign the CVE ID.

Patchstack's advisory is dated September 7; the official CVE publication timestamp is September 8. The research narrative summarizes the original assessment, while version ranges, severity, and remediation follow the public record.

References

• Official CVE record ↗
• Patchstack advisory ↗
• WordPress plugin listing ↗