CVE-2026-103912: reflected DOM XSS in JetFormBuilder

Status: fixed in 3.6.6.1. Advisory published by Wordfence, credited to Zenith-sec.

This is a stub with the public advisory facts. The full writeup — with PoC, evidence and the fix — will be published here. I won’t invent technical detail that isn’t documented yet.

Advisory summary

• CVE: CVE-2026-103912
• Product: JetFormBuilder
• Affected versions: <= 3.6.6
• Type: Reflected DOM XSS
• CVSS: 4.7
• Fixed in: 3.6.6.1
• Vector: Dynamic Preset query_var + data-jfb-macro / JFB_FIELD::
• Advisory: Wordfence
• Credit: Zenith-sec

{
  "cve": "CVE-2026-103912",
  "product": "JetFormBuilder",
  "affected": "<= 3.6.6",
  "type": "Reflected DOM XSS",
  "cvss": 4.7,
  "fixed": "3.6.6.1",
  "source": "Wordfence",
  "credit": "Zenith-sec"
}

Coming next

• the full query_var flow to the DOM sink;
• minimal payload and browser execution;
• the 3.6.6.1 patch excerpt;
• a checklist for anyone still on 3.6.6 or earlier.

References

• CVE.org record
• Wordfence advisory (published in their threat intel)
• Fixed version: JetFormBuilder 3.6.6.1

In progress: PoC, evidence and the patch diff will be published here.