# CVE-2026-97342: JetFormBuilder Stored Cross-Site Scripting in Select field choice meta

Source: https://junglewise.ai/threats/cve-2026-97342-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-97342 · Severity: high · CVSS 7.2 · Published 2026-10-02

The JetFormBuilder plugin for WordPress allows website builders to create dynamic forms. An attacker can inject malicious JavaScript through form submissions that gets stored in the database and executed whenever visitors view pages containing the affected form, potentially compromising website visitors' data and sessions.

Technologies: [Crocoblock JetFormBuilder](https://junglewise.ai/threats/technologies/jetformbuilder). Vendors: [Crocoblock](https://junglewise.ai/threats/vendors/crocoblock).

## Quick answers

**Is CVE-2026-97342 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97342 being exploited in the wild.

**How severe is CVE-2026-97342?** High severity, with a CVSS score of 7.2, published 2 October 2026.

**Which products and versions are affected?** Crocoblock JetFormBuilder up to and including 3.6.5.4.

**Is there a fix for CVE-2026-97342?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-97342 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-97342?** Check whether you run Crocoblock JetFormBuilder at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Stored XSS vulnerability in the Select Field block template caused by insufficient input sanitization of the 'choice' post meta via the unauthenticated Insert/Update Post Action endpoint (wp_ajax_nopriv_jet_form_builder_submit). Attacker-controlled payloads are stored verbatim and later rendered unescaped when the get_from_db option generator copies meta values into HTML attributes and content, allowing arbitrary JavaScript execution in the context of authenticated users viewing the page.

## Affected products

- Crocoblock JetFormBuilder up to and including 3.6.5.4

## Timeline

- 2026-10-02: disclosed

## References

- [https://github.com/Crocoblock/jetformbuilder/commit/534c2ce996408d1f9b5a9fba165348a7cd38bccc](https://github.com/Crocoblock/jetformbuilder/commit/534c2ce996408d1f9b5a9fba165348a7cd38bccc)
- [https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/includes/classes/tools.php](https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/includes/classes/tools.php)

## Related threats

- [Crocoblock JetFormBuilder stored cross-site scripting](https://junglewise.ai/threats/cve-2026-123482-improper-neutralization-of-input-during-web-page-generation)
- [Crocoblock JetFormBuilder cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-123484-improper-neutralization-of-input-during-web-page-generation)
- [Crocoblock JetFormBuilder content injection in form pages](https://junglewise.ai/threats/cve-2026-123860-improper-neutralization-of-script-related-html-tags-in-a-web)
- [Crocoblock JetFormBuilder stored XSS in form fields](https://junglewise.ai/threats/cve-2026-123483-improper-neutralization-of-script-related-html-tags-in-a-web)
- [JetFormBuilder Stored Cross-Site Scripting via form field mapping](https://junglewise.ai/threats/cve-2026-119183-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for)