WordPress security by component

JetFormBuilder — Dynamic Blocks Form Builder

Plugin description

JetFormBuilder — Dynamic Blocks Form Builder is a WordPress component with 12 published CVE records in this archive. The latest tracked vulnerability was published Jul 02, 2026; the highest CVE/CNA score is 9.9.

Plugin slug: jetformbuilder

Latest vulnerability

CVE-2026-13459: JetFormBuilder — Dynamic Blocks Form Builder: A security weakness

JetFormBuilder — Dynamic Blocks Form Builder is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.6.3.

PublishedJul 02, 2026

Known safe version> 3.6.3

		Safe version
Jul 02, 2026	CVE-2026-13459 JetFormBuilder — Dynamic Blocks Form Builder: A security weakness JetFormBuilder — Dynamic Blocks Form Builder is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.6.3.	> 3.6.3	CVE5.3 NVDPending
Jun 17, 2026	CVE-2026-54196 JetFormBuilder: Privilege escalation or authentication bypass JetFormBuilder is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 3.6.1.	3.6.1.1	CVE6.8 NVDPending
Jun 17, 2026	CVE-2026-54195 JetFormBuilder: Cross-site scripting JetFormBuilder is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 3.6.0.1.	3.6.1	CVE7.1 NVDPending
Mar 25, 2026	CVE-2026-32525 JetFormBuilder: Code execution JetFormBuilder is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a through <= 3.5.6.1.	3.5.6.2	CVE9.9 NVDPending
Mar 21, 2026	CVE-2026-4373 JetFormBuilder: Filesystem traversal JetFormBuilder is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.	See mitigation notes	CVE7.5 NVDPending
Dec 16, 2025	CVE-2025-11991 JetFormBuilder — Dynamic Blocks Form Builder: A security weakness JetFormBuilder — Dynamic Blocks Form Builder is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Nov 13, 2025	CVE-2025-64384 JetFormBuilder: A security weakness JetFormBuilder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.3 NVDPending
Jul 16, 2025	CVE-2025-53990 JetFormBuilder: Code execution JetFormBuilder is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.	See mitigation notes	CVE7.2 NVDPending
Aug 03, 2024	CVE-2024-7291 JetFormBuilder: Privilege escalation or authentication bypass JetFormBuilder is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated WordPress account. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE7.2 NVDPending
May 17, 2024	CVE-2023-37866 JetFormBuilder: Privilege escalation or authentication bypass JetFormBuilder is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.	See mitigation notes	CVE7.2 NVDPending
Apr 24, 2024	CVE-2023-48763 JetFormBuilder: Cross-site scripting JetFormBuilder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.3 NVDPending
May 28, 2023	CVE-2023-33212 Jetformbuilder: Cross-site request forgery Jetformbuilder is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.	See mitigation notes	CVE4.3 NVD8.8