Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-103912 (GCVE-0-2026-103912)

Vulnerability from nvd – Published: 2026-10-10 05:31 – Updated: 2026-10-11 12:23

Title

JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer

Summary

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '<attacker-chosen query var name matching the preset's query_var setting>' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on pages embedding a form that has a text field configured with a query_var Dynamic Preset and a data-jfb-macro or JFB_FIELD:: macro reference targeting that field, both of which are standard, documented plugin features.

Severity

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-11 12:15 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

5 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/changeset/3733…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.6.6 (semver)

Credits

Zenith-sec

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103912",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T12:15:03.325470Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T12:23:56.745Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zenith-sec"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the \u0027\u003cattacker-chosen query var name matching the preset\u0027s query_var setting\u003e\u0027 parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on pages embedding a form that has a text field configured with a query_var Dynamic Preset and a data-jfb-macro or JFB_FIELD:: macro reference targeting that field, both of which are standard, documented plugin features."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T05:31:06.244Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e75b6080-25e8-462c-b785-dbdacc10dfe6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.6/assets/build/frontend/main.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.6/includes/presets/sources/preset-source-query-var.php#L32"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.6/includes/presets/sources/preset-source-query-var.php#L19"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3733851/jetformbuilder/trunk/assets/build/frontend/main.js"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-01T14:32:38.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T17:16:02.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via \u0027query_var\u0027 Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-103912",
    "datePublished": "2026-10-10T05:31:06.244Z",
    "dateReserved": "2026-10-01T14:17:25.176Z",
    "dateUpdated": "2026-10-11T12:23:56.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-97342 (GCVE-0-2026-97342)

Vulnerability from nvd – Published: 2026-10-02 07:39 – Updated: 2026-10-03 15:42

Title

JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action

Summary

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-03 15:34 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

7 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://github.com/Crocoblock/jetformbuilder/comm…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.6.5.4 (semver)

Credits

UKO

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97342",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:34:46.933009Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:49.379Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.5.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "UKO"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027choice\u0027 Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T07:39:26.340Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84857045-833f-44fb-ada0-1e0f4eb84a52?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/modules/option-field/blocks/select/block-template.php#L131"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/includes/form-handler.php#L85"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/includes/classes/tools.php#L574"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/modules/actions-v2/insert-post/properties/post-meta-property.php#L152"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/includes/generators/get-from-db.php#L226"
        },
        {
          "url": "https://github.com/Crocoblock/jetformbuilder/commit/534c2ce996408d1f9b5a9fba165348a7cd38bccc#diff-f60e64a78a96f00501af389dc216067c8335cd91ee7296e6c7d960f89dae7d20R547-R551"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-24T12:39:30.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-01T19:00:40.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via \u0027choice\u0027 Post Meta via Insert/Update Post Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-97342",
    "datePublished": "2026-10-02T07:39:26.340Z",
    "dateReserved": "2026-09-24T12:24:24.513Z",
    "dateUpdated": "2026-10-03T15:42:49.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92212 (GCVE-0-2026-92212)

Vulnerability from nvd – Published: 2026-09-25 06:39 – Updated: 2026-09-25 13:00

Title

JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field

Summary

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to host a form configured with both a URL Query Variable preset field and a Calculated Field that references it, which are standard plugin features.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-25 12:53 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

6 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/changeset?repo…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.6.5.3 (semver)

Credits

Tarcísio Luchesi De Almeida Silva (Poystick)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92212",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T12:53:18.259099Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T13:00:17.388Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.5.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tarc\u00edsio Luchesi De Almeida Silva (Poystick)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via \u0027jfb_xss\u0027 (URL Query Variable) Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to host a form configured with both a URL Query Variable preset field and a Calculated Field that references it, which are standard plugin features."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T06:39:52.265Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/37a72530-35d0-4fe8-82c6-50c87f61e731?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/assets/build/frontend/main.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/includes/presets/sources/preset-source-query-var.php#L21"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/includes/blocks/render/calculated-field-render.php#L42"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/templates/fields/calculated-field.php#L31"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3707612%40jetformbuilder\u0026new=3707612%40jetformbuilder"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T18:35:03.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-24T18:25:14.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.6.5.3 - Reflected Cross-Site Scripting via \u0027jfb_xss\u0027 (URL Query Variable) Parameter via Calculated Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-92212",
    "datePublished": "2026-09-25T06:39:52.265Z",
    "dateReserved": "2026-09-15T18:19:57.878Z",
    "dateUpdated": "2026-09-25T13:00:17.388Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12793 (GCVE-0-2026-12793)

Vulnerability from nvd – Published: 2026-09-16 03:28 – Updated: 2026-09-17 17:06

Title

JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

Summary

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 17:06 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

2 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/changeset/3575…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.6.2 (semver)

Credits

daroo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12793",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T17:06:39.371670Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T17:06:49.102Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daroo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post\u0027s content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T03:28:18.961Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a61b2ecc-d4e1-4e71-9187-ddc3d3616a29?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3575346/jetformbuilder"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-11T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-06-20T13:28:13.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-15T15:08:34.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.6.2 - Unauthenticated Privilege Escalation via \u0027_jet_engine_booking_form_id\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-12793",
    "datePublished": "2026-09-16T03:28:18.961Z",
    "dateReserved": "2026-06-20T13:12:52.870Z",
    "dateUpdated": "2026-09-17T17:06:49.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-13459 (GCVE-0-2026-13459)

Vulnerability from nvd – Published: 2026-07-02 08:33 – Updated: 2026-07-02 15:01

Title

JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter

Summary

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-02 15:01 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

12 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/changeset?sfp_…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.6.3 (semver)

Credits

Niv Kochan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-13459",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-02T15:01:25.296369Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-02T15:01:30.738Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Niv Kochan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site \u2014 including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta \u2014 provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site\u0027s public forms."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-02T08:33:05.757Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/26c19bd3-32ea-4e28-9cde-1a6653acf6f1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/includes/generators/get-from-db.php#L118"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/modules/option-field/rest-api/generator-update-endpoint.php#L52"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/modules/option-field/rest-api/generator-update-endpoint.php#L80"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/modules/option-field/rest-api/generator-update-endpoint.php#L140"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/includes/generators/get-from-db.php#L160"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/includes/generators/get-from-db.php#L118"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/modules/option-field/rest-api/generator-update-endpoint.php#L52"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/modules/option-field/rest-api/generator-update-endpoint.php#L80"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/modules/option-field/rest-api/generator-update-endpoint.php#L140"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/includes/generators/get-from-db.php#L160"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3591404%40jetformbuilder\u0026new=3591404%40jetformbuilder\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-26T19:53:15.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-07-01T19:57:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via \u0027context\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-13459",
    "datePublished": "2026-07-02T08:33:05.757Z",
    "dateReserved": "2026-06-26T19:37:59.929Z",
    "dateUpdated": "2026-07-02T15:01:30.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-4373 (GCVE-0-2026-4373)

Vulnerability from nvd – Published: 2026-03-21 06:45 – Updated: 2026-04-08 16:37

Title

JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field

Summary

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File_Tools::is_same_file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-24 14:05 UTC

CWE

CWE-36 - Absolute Path Traversal

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

5 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/changeset/3486…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.5.6.2 (semver)

Credits

daroo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T14:05:08.517261Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-24T14:05:24.476Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.5.6.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daroo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the \u0027Uploaded_File::set_from_array\u0027 method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in \u0027File_Tools::is_same_file\u0027 that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-36",
              "description": "CWE-36 Absolute Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:37:34.037Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1801fd3e-d56f-4540-9700-9e9de8b465e1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/includes/classes/resources/uploaded-file.php#L99"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/modules/block-parsers/file-uploader.php#L313"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/modules/actions-v2/send-email/send-email-action.php#L214"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3486996/jetformbuilder"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-18T10:30:55.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-03-20T18:28:08.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-4373",
    "datePublished": "2026-03-21T06:45:13.779Z",
    "dateReserved": "2026-03-18T10:15:15.895Z",
    "dateUpdated": "2026-04-08T16:37:34.037Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-11991 (GCVE-0-2025-11991)

Vulnerability from nvd – Published: 2025-12-16 07:21 – Updated: 2026-04-08 17:19

Title

JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation

Summary

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-16 21:34 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

2 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.5.3 (semver)

Credits

Tri Firdyanto

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-16T21:34:27.628131Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-16T21:34:34.711Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.5.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tri Firdyanto"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site\u0027s AI usage limits."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:19:38.755Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c08444ef-77bc-4e9d-8d94-04b90cc99ded?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.2.1/modules/ai/rest-api/endpoints/generate-form-endpoint.php#L26"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-12T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2025-10-20T20:24:16.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-12-15T18:47:07.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.5.3 - Missing Authorization to Unauthenticated Form Generation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-11991",
    "datePublished": "2025-12-16T07:21:06.272Z",
    "dateReserved": "2025-10-20T19:44:03.576Z",
    "dateUpdated": "2026-04-08T17:19:38.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-7291 (GCVE-0-2024-7291)

Vulnerability from nvd – Published: 2024-08-03 06:41 – Updated: 2026-04-08 16:35

Title

JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation

Summary

The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-07 15:54 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

3 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…

Impacted products

2 products

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.3.4.1 (semver)
crocoblock	jetelements	Affected: 0 , ≤ 3.3.4.1 (custom) cpe:2.3:a:crocoblock:jetelements::::::wordpress::*

Credits

István Márton

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:crocoblock:jetelements:*:*:*:*:*:wordpress:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jetelements",
            "vendor": "crocoblock",
            "versions": [
              {
                "lessThanOrEqual": "3.3.4.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7291",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-07T15:54:53.023275Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:57:47.794Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.3.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Istv\u00e1n M\u00e1rton"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:35:16.857Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8ea1c2-7c6e-43b3-97ca-a06438d51d11?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.4.1/includes/actions/types/register-user.php#L220"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.4.1/includes/actions/methods/update-user/user-meta-property.php#L23"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-07-30T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2024-07-31T00:00:00.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2024-08-02T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-7291",
    "datePublished": "2024-08-03T06:41:39.862Z",
    "dateReserved": "2024-07-30T14:29:14.301Z",
    "dateUpdated": "2026-04-08T16:35:16.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-103912 (GCVE-0-2026-103912)

Vulnerability from cvelistv5 – Published: 2026-10-10 05:31 – Updated: 2026-10-11 12:23

Title

JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer

Summary

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '<attacker-chosen query var name matching the preset's query_var setting>' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on pages embedding a form that has a text field configured with a query_var Dynamic Preset and a data-jfb-macro or JFB_FIELD:: macro reference targeting that field, both of which are standard, documented plugin features.

Severity

4.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-11 12:15 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

5 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/changeset/3733…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.6.6 (semver)

Credits

Zenith-sec

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103912",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-11T12:15:03.325470Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-11T12:23:56.745Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Zenith-sec"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the \u0027\u003cattacker-chosen query var name matching the preset\u0027s query_var setting\u003e\u0027 parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is only exploitable on pages embedding a form that has a text field configured with a query_var Dynamic Preset and a data-jfb-macro or JFB_FIELD:: macro reference targeting that field, both of which are standard, documented plugin features."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-10T05:31:06.244Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e75b6080-25e8-462c-b785-dbdacc10dfe6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.6/assets/build/frontend/main.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.6/includes/presets/sources/preset-source-query-var.php#L32"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.6/includes/presets/sources/preset-source-query-var.php#L19"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3733851/jetformbuilder/trunk/assets/build/frontend/main.js"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-01T14:32:38.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-09T17:16:02.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via \u0027query_var\u0027 Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-103912",
    "datePublished": "2026-10-10T05:31:06.244Z",
    "dateReserved": "2026-10-01T14:17:25.176Z",
    "dateUpdated": "2026-10-11T12:23:56.745Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-97342 (GCVE-0-2026-97342)

Vulnerability from cvelistv5 – Published: 2026-10-02 07:39 – Updated: 2026-10-03 15:42

Title

JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action

Summary

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-03 15:34 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

7 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://github.com/Crocoblock/jetformbuilder/comm…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.6.5.4 (semver)

Credits

UKO

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-97342",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-03T15:34:46.933009Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-03T15:42:49.379Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.5.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "UKO"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via \u0027choice\u0027 Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is submitted via the unauthenticated wp_ajax_nopriv_jet_form_builder_submit endpoint, stored verbatim into post meta through the Insert/Update Post action, and later rendered unescaped by the Select Field block template when the get_from_db option generator copies raw meta values into option value attributes and label content."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T07:39:26.340Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/84857045-833f-44fb-ada0-1e0f4eb84a52?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/modules/option-field/blocks/select/block-template.php#L131"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/includes/form-handler.php#L85"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/includes/classes/tools.php#L574"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/modules/actions-v2/insert-post/properties/post-meta-property.php#L152"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.4/includes/generators/get-from-db.php#L226"
        },
        {
          "url": "https://github.com/Crocoblock/jetformbuilder/commit/534c2ce996408d1f9b5a9fba165348a7cd38bccc#diff-f60e64a78a96f00501af389dc216067c8335cd91ee7296e6c7d960f89dae7d20R547-R551"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-24T12:39:30.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-01T19:00:40.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via \u0027choice\u0027 Post Meta via Insert/Update Post Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-97342",
    "datePublished": "2026-10-02T07:39:26.340Z",
    "dateReserved": "2026-09-24T12:24:24.513Z",
    "dateUpdated": "2026-10-03T15:42:49.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92212 (GCVE-0-2026-92212)

Vulnerability from cvelistv5 – Published: 2026-09-25 06:39 – Updated: 2026-09-25 13:00

Title

JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field

Summary

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to host a form configured with both a URL Query Variable preset field and a Calculated Field that references it, which are standard plugin features.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-25 12:53 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

6 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/changeset?repo…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.6.5.3 (semver)

Credits

Tarcísio Luchesi De Almeida Silva (Poystick)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92212",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-25T12:53:18.259099Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-25T13:00:17.388Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.5.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tarc\u00edsio Luchesi De Almeida Silva (Poystick)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via \u0027jfb_xss\u0027 (URL Query Variable) Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted page to host a form configured with both a URL Query Variable preset field and a Calculated Field that references it, which are standard plugin features."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T06:39:52.265Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/37a72530-35d0-4fe8-82c6-50c87f61e731?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/assets/build/frontend/main.js"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/includes/presets/sources/preset-source-query-var.php#L21"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/includes/blocks/render/calculated-field-render.php#L42"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.5.3/templates/fields/calculated-field.php#L31"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3707612%40jetformbuilder\u0026new=3707612%40jetformbuilder"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-09-15T18:35:03.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-24T18:25:14.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.6.5.3 - Reflected Cross-Site Scripting via \u0027jfb_xss\u0027 (URL Query Variable) Parameter via Calculated Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-92212",
    "datePublished": "2026-09-25T06:39:52.265Z",
    "dateReserved": "2026-09-15T18:19:57.878Z",
    "dateUpdated": "2026-09-25T13:00:17.388Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-12793 (GCVE-0-2026-12793)

Vulnerability from cvelistv5 – Published: 2026-09-16 03:28 – Updated: 2026-09-17 17:06

Title

JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

Summary

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-17 17:06 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

2 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/changeset/3575…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.6.2 (semver)

Credits

daroo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-12793",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-17T17:06:39.371670Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-17T17:06:49.102Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daroo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post\u0027s content as form schema and executing an Advanced Validation server-side callback. This makes it possible for unauthenticated attackers to create a new administrator-level user account."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T03:28:18.961Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a61b2ecc-d4e1-4e71-9187-ddc3d3616a29?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3575346/jetformbuilder"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-11T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2026-06-20T13:28:13.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-09-15T15:08:34.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.6.2 - Unauthenticated Privilege Escalation via \u0027_jet_engine_booking_form_id\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-12793",
    "datePublished": "2026-09-16T03:28:18.961Z",
    "dateReserved": "2026-06-20T13:12:52.870Z",
    "dateUpdated": "2026-09-17T17:06:49.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-13459 (GCVE-0-2026-13459)

Vulnerability from cvelistv5 – Published: 2026-07-02 08:33 – Updated: 2026-07-02 15:01

Title

JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter

Summary

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-02 15:01 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

12 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/changeset?sfp_…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.6.3 (semver)

Credits

Niv Kochan

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-13459",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-02T15:01:25.296369Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-02T15:01:30.738Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.6.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Niv Kochan"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site \u2014 including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta \u2014 provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site\u0027s public forms."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-02T08:33:05.757Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/26c19bd3-32ea-4e28-9cde-1a6653acf6f1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/includes/generators/get-from-db.php#L118"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/modules/option-field/rest-api/generator-update-endpoint.php#L52"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/modules/option-field/rest-api/generator-update-endpoint.php#L80"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/modules/option-field/rest-api/generator-update-endpoint.php#L140"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.3/includes/generators/get-from-db.php#L160"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/includes/generators/get-from-db.php#L118"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/modules/option-field/rest-api/generator-update-endpoint.php#L52"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/modules/option-field/rest-api/generator-update-endpoint.php#L80"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/modules/option-field/rest-api/generator-update-endpoint.php#L140"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.6.0/includes/generators/get-from-db.php#L160"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3591404%40jetformbuilder\u0026new=3591404%40jetformbuilder\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-26T19:53:15.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-07-01T19:57:13.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via \u0027context\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-13459",
    "datePublished": "2026-07-02T08:33:05.757Z",
    "dateReserved": "2026-06-26T19:37:59.929Z",
    "dateUpdated": "2026-07-02T15:01:30.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-4373 (GCVE-0-2026-4373)

Vulnerability from cvelistv5 – Published: 2026-03-21 06:45 – Updated: 2026-04-08 16:37

Title

JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field

Summary

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File_Tools::is_same_file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-03-24 14:05 UTC

CWE

CWE-36 - Absolute Path Traversal

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

5 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/changeset/3486…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.5.6.2 (semver)

Credits

daroo

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-4373",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-24T14:05:08.517261Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-24T14:05:24.476Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.5.6.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "daroo"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the \u0027Uploaded_File::set_from_array\u0027 method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in \u0027File_Tools::is_same_file\u0027 that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-36",
              "description": "CWE-36 Absolute Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:37:34.037Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1801fd3e-d56f-4540-9700-9e9de8b465e1?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/includes/classes/resources/uploaded-file.php#L99"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/modules/block-parsers/file-uploader.php#L313"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.6.2/modules/actions-v2/send-email/send-email-action.php#L214"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3486996/jetformbuilder"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-18T10:30:55.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-03-20T18:28:08.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-4373",
    "datePublished": "2026-03-21T06:45:13.779Z",
    "dateReserved": "2026-03-18T10:15:15.895Z",
    "dateUpdated": "2026-04-08T16:37:34.037Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-11991 (GCVE-0-2025-11991)

Vulnerability from cvelistv5 – Published: 2025-12-16 07:21 – Updated: 2026-04-08 17:19

Title

JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation

Summary

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-12-16 21:34 UTC

CWE

CWE-862 - Missing Authorization

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

2 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…

Impacted products

1 product

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.5.3 (semver)

Credits

Tri Firdyanto

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-11991",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-12-16T21:34:27.628131Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-12-16T21:34:34.711Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.5.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tri Firdyanto"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder \u2014 Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site\u0027s AI usage limits."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T17:19:38.755Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c08444ef-77bc-4e9d-8d94-04b90cc99ded?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.5.2.1/modules/ai/rest-api/endpoints/generate-form-endpoint.php#L26"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2025-10-12T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2025-10-20T20:24:16.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2025-12-15T18:47:07.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.5.3 - Missing Authorization to Unauthenticated Form Generation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2025-11991",
    "datePublished": "2025-12-16T07:21:06.272Z",
    "dateReserved": "2025-10-20T19:44:03.576Z",
    "dateUpdated": "2026-04-08T17:19:38.755Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-7291 (GCVE-0-2024-7291)

Vulnerability from cvelistv5 – Published: 2024-08-03 06:41 – Updated: 2026-04-08 16:35

Title

JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation

Summary

The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-07 15:54 UTC

CWE

CWE-269 - Improper Privilege Management

Assigner

Wordfence CNA under the mitre root

CNA scorecard C 65/100 over 2273 records in the last 180 days details

References

3 references

URL	Tags
https://www.wordfence.com/threat-intel/vulnerabil…
https://plugins.trac.wordpress.org/browser/jetfor…
https://plugins.trac.wordpress.org/browser/jetfor…

Impacted products

2 products

Vendor	Product	Version
jetmonsters	JetFormBuilder — Dynamic Blocks Form Builder	Affected: 0 , ≤ 3.3.4.1 (semver)
crocoblock	jetelements	Affected: 0 , ≤ 3.3.4.1 (custom) cpe:2.3:a:crocoblock:jetelements::::::wordpress::*

Credits

István Márton

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:crocoblock:jetelements:*:*:*:*:*:wordpress:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "jetelements",
            "vendor": "crocoblock",
            "versions": [
              {
                "lessThanOrEqual": "3.3.4.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7291",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-07T15:54:53.023275Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:57:47.794Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "JetFormBuilder \u2014 Dynamic Blocks Form Builder",
          "vendor": "jetmonsters",
          "versions": [
            {
              "lessThanOrEqual": "3.3.4.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Istv\u00e1n M\u00e1rton"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-08T16:35:16.857Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0d8ea1c2-7c6e-43b3-97ca-a06438d51d11?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.4.1/includes/actions/types/register-user.php#L220"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/jetformbuilder/tags/3.3.4.1/includes/actions/methods/update-user/user-meta-property.php#L23"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-07-30T00:00:00.000Z",
          "value": "Discovered"
        },
        {
          "lang": "en",
          "time": "2024-07-31T00:00:00.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2024-08-02T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "JetFormBuilder \u003c= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2024-7291",
    "datePublished": "2024-08-03T06:41:39.862Z",
    "dateReserved": "2024-07-30T14:29:14.301Z",
    "dateUpdated": "2026-04-08T16:35:16.857Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

16 vulnerabilities found for JetFormBuilder — Dynamic Blocks Form Builder by jetmonsters

CVE-2026-103912 (GCVE-0-2026-103912)

CVE-2026-97342 (GCVE-0-2026-97342)

CVE-2026-92212 (GCVE-0-2026-92212)

CVE-2026-12793 (GCVE-0-2026-12793)

CVE-2026-13459 (GCVE-0-2026-13459)

CVE-2026-4373 (GCVE-0-2026-4373)

CVE-2025-11991 (GCVE-0-2025-11991)

CVE-2024-7291 (GCVE-0-2024-7291)

CVE-2026-103912 (GCVE-0-2026-103912)

CVE-2026-97342 (GCVE-0-2026-97342)

CVE-2026-92212 (GCVE-0-2026-92212)

CVE-2026-12793 (GCVE-0-2026-12793)

CVE-2026-13459 (GCVE-0-2026-13459)

CVE-2026-4373 (GCVE-0-2026-4373)

CVE-2025-11991 (GCVE-0-2025-11991)

CVE-2024-7291 (GCVE-0-2024-7291)