# CVE-2026-19859: JetFormBuilder arbitrary shortcode execution via status parameter

Source: https://junglewise.ai/threats/cve-2026-19859-jetformbuilder-arbitrary-shortcode-execution-via-status-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-06. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19859 · Severity: medium · CVSS 6.5 · Published 2026-09-06

JetFormBuilder is a WordPress plugin for creating form layouts and submissions. The plugin fails to properly sanitize user input before rendering it, allowing attackers to execute arbitrary WordPress shortcodes on any page displaying a form without requiring authentication. This could allow attackers to inject malicious content, deface sites, steal data, or redirect users to malicious sites.

Technologies: [Crocoblock JetFormBuilder](https://junglewise.ai/threats/technologies/jetformbuilder). Vendors: [Crocoblock](https://junglewise.ai/threats/vendors/crocoblock).

## Quick answers

**Is CVE-2026-19859 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19859 being exploited in the wild.

**How severe is CVE-2026-19859?** Medium severity, with a CVSS score of 6.5, published 6 September 2026.

**Which products and versions are affected?** Crocoblock JetFormBuilder before 3.6.5.2.

**Is there a fix for CVE-2026-19859?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-19859 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-19859?** Check whether you run Crocoblock JetFormBuilder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an injection flaw in the JetFormBuilder WordPress plugin versions before 3.6.5.2. The plugin accepts an unsanitized 'status' parameter and renders it as message content within form pages. Although escaping is applied, it occurs before WordPress processes shortcodes rather than after, allowing attackers to bypass the escaping by nesting shortcodes with double brackets. The attack requires no authentication and the vulnerable form need only be present on a publicly accessible page. Attackers can execute any registered WordPress shortcode on the site, potentially reflecting attributes without output filtering, leading to content injection and data exfiltration via shortcodes that support attribute reflection.

## Affected products

- Crocoblock JetFormBuilder before 3.6.5.2

## Timeline

- 2026-09-03: disclosed
- 2026-09-06: published

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/19c115a5-4280-4b78-a460-140ecfc78d4f/](https://wpscan.com/vulnerability/19c115a5-4280-4b78-a460-140ecfc78d4f/)

## Related threats

- [Crocoblock JetFormBuilder stored cross-site scripting](https://junglewise.ai/threats/cve-2026-123482-improper-neutralization-of-input-during-web-page-generation)
- [Crocoblock JetFormBuilder cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-123484-improper-neutralization-of-input-during-web-page-generation)
- [Crocoblock JetFormBuilder content injection in form pages](https://junglewise.ai/threats/cve-2026-123860-improper-neutralization-of-script-related-html-tags-in-a-web)
- [Crocoblock JetFormBuilder stored XSS in form fields](https://junglewise.ai/threats/cve-2026-123483-improper-neutralization-of-script-related-html-tags-in-a-web)
- [JetFormBuilder Stored Cross-Site Scripting via form field mapping](https://junglewise.ai/threats/cve-2026-119183-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for)