Plugin icon

JetFormBuilder — Dynamic Blocks Form Builder

jetformbuilder

Vulnerabilities:

18

Last Updated:

September 14, 2026

Active Installs:

80000

Published
Title
Fixed in
CVSS
Published
2026-09-15
Title
JetFormBuilder < 3.6.2.1 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
Fixed in
Fixed in 3.6.2.1
CVSS
9.8 (critical)
Published
2026-09-07
Title
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.6.5.2
CVSS
7.2 (high)
Published
2026-09-03
Title
JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter
Fixed in
Fixed in 3.6.5.2
CVSS
6.5 (medium)
Published
2026-09-03
Title
JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails
Fixed in
Fixed in 3.6.5.2
CVSS
4.7 (medium)
Published
2026-09-03
Title
JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset
Fixed in
Fixed in 3.6.5.2
CVSS
7.5 (high)
Published
2026-09-03
Title
JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action
Fixed in
Fixed in 3.6.5.2
CVSS
4.8 (medium)
Published
2026-08-04
Title
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.4.2 - Missing Authorization
Fixed in
Fixed in 3.6.4.2
CVSS
5.3 (medium)
Published
2026-07-01
Title
JetFormBuilder < 3.6.3.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
Fixed in
Fixed in 3.6.3.1
CVSS
5.3 (medium)
Published
2026-06-16
Title
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.1 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 3.6.1
CVSS
7.2 (high)
Published
2026-06-16
Title
JetFormBuilder — Dynamic Blocks Form Builder < 3.6.1.1 - Subscriber+ Privilege Escalation
Fixed in
Fixed in 3.6.1.1
CVSS
8.8 (high)
Published
2026-03-23
Title
JetFormBuilder — Dynamic Blocks Form Builder < 3.5.6.2 - Authenticated (Contributor+) Remote Code Execution
Fixed in
Fixed in 3.5.6.2
CVSS
7.2 (high)
Published
2026-03-20
Title
JetFormBuilder < 3.5.6.3 - Unauthenticated Arbitrary File Read via Media Field
Fixed in
Fixed in 3.5.6.3
CVSS
7.5 (high)
Published
2025-12-15
Title
JetFormBuilder < 3.5.4 - Missing Authorization to Unauthenticated Form Generation
Fixed in
Fixed in 3.5.4
CVSS
5.3 (medium)
Published
2025-11-29
Title
JetFormBuilder < 3.5.4 - Missing Authorization
Fixed in
Fixed in 3.5.4
CVSS
5.3 (medium)
Published
2025-07-16
Title
JetFormBuilder < 3.5.2 - Authenticated (Administrator+) PHP Object Injection
Fixed in
Fixed in 3.5.2
CVSS
6.6 (medium)
Published
2024-08-02
Title
JetFormBuilder < 3.3.4.2 - Authenticated (Administrator+) Privilege Escalation
Fixed in
Fixed in 3.3.4.2
CVSS
7.2 (high)
Published
2023-11-28
Title
JetFormBuilder < 3.1.5 - Unauthenticated Content Injection
Fixed in
Fixed in 3.1.5
CVSS
5.3 (medium)
Published
2023-05-24
Title
JetFormBuilder < 3.0.7 - Cross-Site Request Forgery (CSRF)
Fixed in
Fixed in 3.0.7
CVSS
4.3 (medium)