Skip to contentJetmonsters Jetformbuilder — Dynamic Blocks Form Builder vulnerabilities
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` PropertyCVE-2026-1219775.4 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset SourceCVE-2026-1113177.2 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post MetaCVE-2026-1191837.2 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page ModificationCVE-2026-1205615.3 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro RendererCVE-2026-1039124.7 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post ActionCVE-2026-973427.2 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated FieldCVE-2026-922126.1 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation CallbackCVE-2026-198605.5 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' ParameterCVE-2026-12793Public exploit9.8 Critical
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification EmailsCVE-2026-198614.7 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic PresetCVE-2026-198587.5 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' ParameterCVE-2026-134595.3 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media FieldCVE-2026-43737.5 High
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form GenerationCVE-2025-119915.3 Medium
- crocoblock jetelements, jetmonsters jetformbuilder — dynamic blocks form builder +1 moreJetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege EscalationCVE-2024-72917.2 High
- crocoblock jetformbuilder, jetformbuilder — dynamic blocks form builder +1 moreWordPress JetFormBuilder Plugin <= 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF)CVE-2023-332124.3 Medium