WordPress security by component
JetFormBuilder
JetFormBuilder (jetformbuilder-dynamic-blocks-form-builder) is a WordPress plugin with 3 published CVE records in this archive. The latest tracked vulnerability was published Sep 19, 2026; the highest published CVSS base score is 7.5.
Plugin slug:
jetformbuilder-dynamic-blocks-form-builderLatest vulnerability
CVE-2026-19860: JetFormBuilder validation callbacks can delete arbitrary files
A user able to manage forms configures a custom PHP validation callback. A blocklist omits a file-deletion function, allowing the configured callback to delete arbitrary server files when anyone submits the form. Configuration requires form-management access; only the trigger is unauthenticated. The export does not disclose the omitted function or callback-field name. Authoritative affected range: 3.5.6.2 to < 3.6.5.3. Confirmed remediation: 3.6.5.3.
| Safe version |
|
||
|---|---|---|---|
| Sep 19, 2026 |
CVE-2026-19860
JetFormBuilder validation callbacks can delete arbitrary files
A user able to manage forms configures a custom PHP validation callback. A blocklist omits a file-deletion function, allowing the configured callback to delete arbitrary server files when anyone submits the form. Configuration requires form-management access; only the trigger is unauthenticated. The export does not disclose the omitted function or callback-field name. Authoritative affected range: 3.5.6.2 to < 3.6.5.3. Confirmed remediation: 3.6.5.3.
|
3.6.5.3 |
CVE5.5
|
| Sep 05, 2026 |
CVE-2026-19861
JetFormBuilder permits unauthenticated HTML injection into notification email
JetFormBuilder before 3.6.5.2 places unauthenticated form-field values into HTML notification messages without adequate sanitization and escaping. An attacker can inject arbitrary rendered markup into mail delivered to administrators and other recipients; script execution depends on the recipient's mail client.
|
3.6.5.2 |
CVE4.7
|
| Sep 05, 2026 |
CVE-2026-19858
JetFormBuilder exposes arbitrary WordPress object and metadata properties
JetFormBuilder before 3.6.5.2 resolves unauthenticated request-derived data during page rendering without authorization checks. A visitor can read arbitrary user, post, and term properties or metadata, including password hashes, draft and private content, and secrets stored by other plugins.
|
3.6.5.2 |
CVE7.5
|