JD
Product
JetFormBuilder — Dynamic Blocks Form Builder
8
CVEs
0
On KEV
9.8
Max CVSS
2
New 30D
Severity mix
Critical 1High 3Medium 4Low 0
Watch
Add JetFormBuilder — Dynamic Blocks Form Builder to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-12793 | 9.8 | Sep 16 | JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter Affected: through 3.6.2 |
| CVE-2026-4373 | 7.5 | Mar 21 | JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field Affected: through 3.5.6.2 |
| CVE-2026-97342 | 7.2 | Oct 2 | JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action Affected: through 3.6.5.4 |
| CVE-2024-7291 | 7.2 | Aug 3 | JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation Affected: through 3.3.4.1 |
| CVE-2026-92212 | 6.1 | Sep 25 | JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field Affected: through 3.6.5.3 |
| CVE-2026-13459 | 5.3 | Jul 2 | JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter Affected: through 3.6.3 |
| CVE-2025-11991 | 5.3 | Dec 16 | JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation Affected: through 3.5.3 |
| CVE-2026-103912 | 4.7 | Oct 10 | JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer Affected: through 3.6.6 |
Showing 8