Unknown Jetformbuilder vulnerabilities

2 CVEs affecting Unknown Jetformbuilder, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19862, published 2026-09-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-19859, published 2026-09-06. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes…
CVE-2026-19862, published 2026-09-06. Medium severity, CVSS 4.8. EPSS: 0.2% chance of exploitation in the next 30 days. The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it…