CVE-2026-19858— JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset
Quick assessment
Affected
Unknown JetFormBuilder — Dynamic Blocks Form Builder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
JetFormBuilder — 动态区块表单构建器 WordPress 插件在 3.6.5.2 版本之前，在页面渲染期间解析来自请求的数据时未执行授权检查，使得未认证的用户能够读取任意用户、文章和术语（分类/标签）的属性及元数据。这些信息包括密码哈希值、私密及草稿内容，以及其他 JetFormBuilder 插件存储在元数据中的机密信息。
Possible ATT&CK Techniques 2 AI
T1212 · Exploitation for Credential Access T1595.001 · Scanning IP Blocks
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19858
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset
Source: CVE Program / CVE List V5
Vulnerability Description
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes, private and draft content, and secrets other JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 store in metadata.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | JetFormBuilder — Dynamic Blocks Form Builder | 0 ~ 3.6.5.2 | - |
|
II. Public POCs for CVE-2026-19858
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19858
请登录查看更多情报信息。
Other References for CVE-2026-19858 (1)
-
https://wpscan.com/vulnerability/a9d091f3-6887-4f26-a736-ba26a81d2b32/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-05 · 34 CVEs total
| CVE-2026-78362 | SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Au | |
| CVE-2026-82846 | Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields | |
| CVE-2026-82304 | Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler | |
| CVE-2026-81424 | Accept Stripe Payments < 2.1.4 - Unauthenticated Product Substitution via IDOR | |
| CVE-2026-83543 | Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint | |
| CVE-2026-83544 | Greenshift < 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute | |
| CVE-2026-81423 | Accept Stripe Payments < 2.1.4 - Open Redirect via IPN Handler | |
| CVE-2026-81348 | My Private Site < 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and | |
| CVE-2026-81404 | IPGP Visitors Origin < 1.6 - Reflected XSS | |
| CVE-2026-84021 | Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via bt_bb_button/bt_bb_headline/bt_bb_ | |
| CVE-2026-77826 | RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Fa | |
| CVE-2026-78149 | Post Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content and post_pas | |
| CVE-2026-78150 | Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure v | |
| CVE-2026-19861 | JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Em | |
| CVE-2026-15247 | Search Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deleti | |
| CVE-2025-15694 | Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS | |
| CVE-2025-15693 | JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal | |
| CVE-2026-84937 | YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax | |
| CVE-2026-84022 | Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attribu | |
| CVE-2026-84221 | Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID |
Showing top 20 of 34 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: JetFormBuilder — Dynamic Blocks Form Builder
-
CVE-2026-19861
JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WY -
CVE-2026-13459
JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthent -
CVE-2026-4373
JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File R -
CVE-2025-11991
JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthent -
CVE-2024-7291
JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) P
Same vendor: Unknown
-
CVE-2026-84937
YT Player < 2.1.0 - Contributor+ SQLi via ytp_ajax -
CVE-2026-84927
EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modif -
CVE-2026-84931
Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli -
CVE-2026-84930
CatFolders Document Gallery < 2.0.7 - Author+ Stored XSS via -
CVE-2026-84936
EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews AP
V. Comments for CVE-2026-19858
No comments yet