JetFormBuilder users should update to 3.6.8.1 or a newer patched release following disclosure of stored cross-site scripting involving post metadata and Calculated Fields.
The Wordfence submission to the CVE Program identifies CVE-2026-119183 in versions through 3.6.8. Wordfence assigns CVSS 3.1 7.2, High.
Check how public forms use saved metadata
The documented attack requires two configured features: a public Insert Post form that writes a submitted value to a post-meta key, and a Calculated Field formula that reads that key through the %META::key% macro.
With that combination, an unauthenticated submission can persist a script payload. The CNA says it executes when a user accesses an injected page. The presence of an affected plugin version alone does not show that a site’s forms meet these prerequisites.
Wordfence’s timeline records disclosure on November 6; the CVE record was published November 7. CISA’s enrichment recorded no exploitation on November 7. This dated assessment cannot rule out unreported attacks.
Verify the update and the form workflow
The developer-maintained changelog lists 3.6.8.1 as fixing stored XSS through post-meta values used in Calculated Field formulas. It also contains other security fixes, so an earlier release’s security notes should not be mistaken for coverage of this flaw.
DaySec recommends checking the installed version and reviewing public forms that create posts. Follow each submitted field’s metadata mapping to any formula that reads it; this makes the configuration check more useful than looking only for Calculated Fields.
After updating, test ordinary submissions and calculations with harmless sample data. Where there are signs of earlier abuse, inspect unexpected saved metadata and related submission records safely before returning affected content to normal use. A software update does not itself establish what was previously stored.
