Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 18

Export CSV
CVE-2026-19861

JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrators and other recipients. Whether injected script executes depends on the recipient's mail client, but the injected markup is rendered regardless.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Jetformbuilder
CVE-2026-123482

WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-123484

WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-123483

WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-123860

WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.8.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-119183

JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<form field mapped to a post meta key, e.g. lst_cost>' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the target site to have configured a public Insert Post form writing to a post meta key and a Calculated Field whose formula references that key via the %META::key% macro, after which a single unauthenticated POST is sufficient to persist the payload.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Jetmonsters Wordpress-extensions
Products
Jetformbuilder — Dynamic Blocks Form Builder Jetformbuilder
CVE-2026-121977

JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note (form field whose value is written to post meta `note`)' parameter in all versions up to, and including, 3.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a privileged user with the edit_others_posts capability to visit a form URL containing the attacker-created post ID, a delivery step the attacker controls via a crafted phishing link.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Jetmonsters Wordpress-extensions
Products
Jetformbuilder — Dynamic Blocks Form Builder Jetformbuilder
CVE-2026-111317

JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<any form field name — e.g. 'payload'>' parameter in all versions up to, and including, 3.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the targeted form to have both the Save Form Record action enabled and a form-level Form Record preset configured; the stored payload only executes when a privileged user visits the front-end form page with the preset's record query variable set to the attacker's submitted record ID.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Jetmonsters Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-119481

WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-120561

JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'do_action' function in the 'Update_Options' action class in all versions up to, and including, 3.6.2. This makes it possible for unauthenticated attackers to modify JetEngine Options Page values when an administrator has configured a form with the "Update Options" post-submission action. The vulnerability requires that both JetFormBuilder and JetEngine are installed and active, and that an administrator has specifically configured a form with the Update Options action.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jetmonsters Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-119480

WordPress JetFormBuilder plugin <= 3.6.7.1 - Attachment Deletion Via Media-Field Preset vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-119479

WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-119482

WordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-107431

WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-103912

JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '<attacker-chosen query var name matching the preset's query_var setting>' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on pages embedding a form that has a text field configured with a query_var Dynamic Preset and a data-jfb-macro or JFB_FIELD:: macro reference targeting that field, both of which are standard, documented plugin features.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Jetmonsters Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-97342

JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Jetmonsters Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-19860

JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Jetmonsters Wordpress-extensions
Products
Jetformbuilder — Dynamic Blocks Form Builder Jetformbuilder