JetFormBuilder — Dynamic Blocks Form Builder

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1. The CNA vector requires low-privilege authenticated access; the exact WordPress role is not disclosed. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Attacker-controlled path input can escape an intended directory; the exact file operation and reachable files are not specified. The structured affected range is <= 3.6.7.1.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. Injected script executes in a victim browser when the affected output is rendered; the required viewer role is not disclosed. The vector marks UI:N, but execution in a victim browser still requires the affected output to be encountered; any additional interaction stated above also remains necessary. The structured affected range is <= 3.6.7.1. The CNA classifies this as basic cross-site scripting/content injection; server-side code execution is not established.

Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.7.1. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. An access-control failure can expose a restricted operation or data; the particular operation and object are not specified. The structured affected range is <= 3.6.7.1.

JetFormBuilder omits authorization from a protected operation. The CNA vector describes unauthenticated access with high availability impact, but no confidentiality or integrity impact. The export does not identify the operation, endpoint, or input, so a specific disruption mechanism cannot be confirmed. Published affected versions: <= 3.6.6.

An unauthenticated attacker can craft a link whose query value feeds a text field configured with a query_var Dynamic Preset. A published form must render that field through a data-jfb-macro or JFB_FIELD macro. The value reaches browser HTML without sufficient escaping, enabling reflected DOM XSS when a victim follows the link. Affected versions: <= 3.6.6. The matching official changelog confirms 3.6.6.1 as fixed for this CVE.

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content. No further endpoint or implementation detail is disclosed beyond the path described here. The official changelog confirms a matching fix in 3.6.6.

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions. The reported impact is browser script execution in the affected site's origin. The injected field, rendering context and exact victim interaction are unspecified. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the precise input-to-operation path cannot be established from this snapshot. The authoritative export identifies the fixed release as 3.6.6.

JetFormBuilder (affected: <= 3.6.5.3). An unauthenticated attacker can lure a victim to a crafted jfb_xss URL query value. A form must have a URL Query Variable preset and a Calculated Field referring to it; unsafe formula handling reflects attacker-controlled content into executable browser output. The exact processing function is unspecified.

Through 3.6.2, an unauthenticated requester can submit a form ID that is not verified to identify a JetFormBuilder form. Referenced post content is parsed as a form schema, and Advanced Validation server-side callback processing can be reached in a way that creates a new administrator account. The export does not disclose the request route, callback name or how attacker-controlled post content is supplied.

JetFormBuilder through 3.6.5.1 allows an unauthenticated attacker to supply script content that executes in another user's browser when that user interacts with affected content. The CNA identifies 3.6.5.2 as unaffected and rates user interaction as required.

JetFormBuilder before 3.6.5.2 places address values sourced from submitted form fields into outgoing e-mail headers without validating or removing line breaks. On sites configured to take a message address from a form field, an unauthenticated submitter can inject additional headers, add hidden recipients, or spoof the sender.

JetFormBuilder before 3.6.5.2 renders attacker-controlled request data as form message content and expands shortcodes after escaping that content. An unauthenticated attacker can use a page displaying a form to execute any shortcode registered on the site, exposing data or invoking actions available through those shortcodes.

JetFormBuilder through 3.6.4.1 exposes an operation without the required authorization to unauthenticated callers.

JetFormBuilder — Dynamic Blocks Form Builder is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 3.6.3.

JetFormBuilder is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated subscriber account. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 3.6.1.

JetFormBuilder is affected by cross-site scripting. The vulnerable path is reachable without authentication. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is n/a through 3.6.0.1.

JetFormBuilder is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a through <= 3.5.6.1.

JetFormBuilder is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.

JetFormBuilder — Dynamic Blocks Form Builder is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation.

JetFormBuilder is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.

JetFormBuilder is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

JetFormBuilder is affected by privilege escalation or authentication bypass. Exploitation requires an authenticated administrator account. A successful request can grant permissions or access that the caller should not possess.

JetFormBuilder is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.

JetFormBuilder is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.

Jetformbuilder is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.