{
 "id": "WPSEC-2026-2324",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2324/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2324/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2324/index.md",
 "title": "JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7.1 - Unauthenticated Arbitrary Shortcode Execution via Submitted Field Macros",
 "description": "The JetFormBuilder plugin for WordPress is vulnerable to arbitrary shortcode execution via submitted field macros in all versions up to, and including, 3.6.7.1, due to submitted field values being substituted into Send Email, Call Webhook, Redirect To Page and Media field limit content through %field% macros before that content is passed to do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting shortcode syntax in a form field used by one of these settings.",
 "plugin": {
  "slug": "jetformbuilder",
  "name": "JetFormBuilder — Dynamic Blocks Form Builder",
  "full_name": "JetFormBuilder — Dynamic Blocks Form Builder",
  "wordpress_org": "https://wordpress.org/plugins/jetformbuilder/",
  "advisories_url": "https://wpsec.com/vuln/plugin/jetformbuilder/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/jetformbuilder"
 },
 "type": "RCE",
 "cwe": [
  "CWE-94"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.3.1",
    "from_inclusive": true,
    "to": "3.6.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.3.1 before 3.6.8"
  ]
 },
 "introduced_in": "3.3.1",
 "fixed_in": "3.6.8",
 "remediation": "Update to 3.6.8 or later.",
 "fix_released": "2026-10-30T10:56:57+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:39:07.184374+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2324/",
  "https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.8/",
  "https://wordpress.org/plugins/jetformbuilder/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/jetformbuilder",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-03"
 }
}