Skip to content

Jetmonsters Jetformbuilder vulnerabilities

crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability CVE-2026-123482 7.1 HighNovember 9, 2026
crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability CVE-2026-123484 7.1 HighNovember 9, 2026
crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability CVE-2026-123860 5.3 MediumNovember 7, 2026
crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability CVE-2026-123483 5.3 MediumNovember 7, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property CVE-2026-121977 5.4 MediumNovember 7, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source CVE-2026-111317 7.2 HighNovember 7, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta CVE-2026-119183 7.2 HighNovember 7, 2026
crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability CVE-2026-119481 9.8 CriticalNovember 4, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification CVE-2026-120561 5.3 MediumNovember 3, 2026
crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability CVE-2026-119480 6.5 MediumNovember 1, 2026
crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability CVE-2026-119479 5.3 MediumOctober 30, 2026
crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerability CVE-2026-119482 5.3 MediumOctober 30, 2026
crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability CVE-2026-107431 7.5 HighOctober 14, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer CVE-2026-103912 4.7 MediumOctober 10, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action CVE-2026-97342 7.2 HighOctober 2, 2026
jetmonsters jetformbuilder WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability CVE-2026-102391 7.1 HighSeptember 30, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field CVE-2026-92212 6.1 MediumSeptember 25, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback CVE-2026-19860 5.5 MediumSeptember 19, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter CVE-2026-12793 Public exploit 9.8 CriticalSeptember 16, 2026
crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-84817 7.1 HighSeptember 8, 2026
jetmonsters jetformbuilder JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action CVE-2026-19862 4.8 MediumSeptember 6, 2026
jetmonsters jetformbuilder JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter CVE-2026-19859 6.5 MediumSeptember 6, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails CVE-2026-19861 4.7 MediumSeptember 5, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset CVE-2026-19858 7.5 HighSeptember 5, 2026
jetmonsters jetformbuilder WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability CVE-2026-28140 7.5 HighAugust 6, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter CVE-2026-13459 5.3 MediumJuly 2, 2026
jetmonsters jetformbuilder WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability CVE-2026-54196 6.8 MediumJune 17, 2026
jetmonsters jetformbuilder WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability CVE-2026-54195 7.1 HighJune 17, 2026
jetmonsters jetformbuilder WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability CVE-2026-32525 9.9 CriticalMarch 25, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field CVE-2026-4373 7.5 HighMarch 21, 2026
jetmonsters jetformbuilder — dynamic blocks form builder JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation CVE-2025-11991 5.3 MediumDecember 16, 2025
jetmonsters jetformbuilder WordPress JetFormBuilder plugin <= 3.5.3 - Broken Access Control vulnerability CVE-2025-64384 5.3 MediumNovember 13, 2025
jetmonsters jetformbuilder WordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection Vulnerability CVE-2025-53990 7.2 HighJuly 16, 2025
crocoblock jetelements, jetmonsters jetformbuilder — dynamic blocks form builder +1 more JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation CVE-2024-7291 7.2 HighAugust 3, 2024
crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.0.8 - Authenticated Privilege Escalation vulnerability CVE-2023-37866 7.2 HighMay 17, 2024
crocoblock jetformbuilder WordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerability CVE-2023-48763 5.3 MediumApril 24, 2024
crocoblock jetformbuilder, jetformbuilder — dynamic blocks form builder +1 more WordPress JetFormBuilder Plugin <= 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-33212 4.3 MediumMay 28, 2023