# JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.7.1 - Unauthenticated Arbitrary Shortcode Execution via Submitted Field Macros

- **ID:** WPSEC-2026-2324
- **Plugin:** JetFormBuilder — Dynamic Blocks Form Builder (`jetformbuilder`), https://wordpress.org/plugins/jetformbuilder/
- **Affected versions:** from 3.3.1 before 3.6.8
- **Fixed in:** 3.6.8 (Update to 3.6.8 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-94
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/jetformbuilder
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2324/

## Description

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary shortcode execution via submitted field macros in all versions up to, and including, 3.6.7.1, due to submitted field values being substituted into Send Email, Call Webhook, Redirect To Page and Media field limit content through %field% macros before that content is passed to do_shortcode(). This makes it possible for unauthenticated attackers to execute arbitrary shortcodes by submitting shortcode syntax in a form field used by one of these settings.

## References

- https://wpsec.com/vuln/WPSEC-2026-2324/
- https://plugins.svn.wordpress.org/jetformbuilder/tags/3.6.8/
- https://wordpress.org/plugins/jetformbuilder/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2324/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.