WordPress plugin
JetFormBuilder — Dynamic Blocks Form Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 37 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High16
- Medium19
- Low0
All JetFormBuilder — Dynamic Blocks Form Builder vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.6.8Update to 3.6.8.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤3.6.8Update to 3.6.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.6.8Update to 3.6.8.1
- Medium6.5Unauthenticated Arbitrary Shortcode Execution
≤3.6.8Update to 3.6.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source
≤3.6.7Update to 3.6.7.1
- Medium5.4Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property
≤3.6.8Update to 3.6.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta
≤3.6.8Update to 3.6.8.1
- High7.3Unauthenticated Privilege Escalation
≤3.6.7.1Update to 3.6.8
- Medium5.3Missing Authorization
≤3.6.7.1Update to 3.6.8
- Medium4.3Authenticated (Subscriber+) Arbitrary Media Attachment Deletion
≤3.6.7.1Update to 3.6.8
- High7.2Unauthenticated Arbitrary Shortcode Execution
≤3.6.7.1Update to 3.6.8
- Medium5.3Missing Authorization
≤3.6.6Update to 3.6.6.1
- Medium4.7Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
≤3.6.6Update to 3.6.6.1
- High7.2Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
≤3.6.5.4Update to 3.6.6
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.6.5.4Update to 3.6.6
- Medium6.1Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
≤3.6.5.3Update to 3.6.5.4
- Medium6.5Authenticated (Administrator+) Arbitrary File Deletion
≤3.6.5.2Update to 3.6.5.3
- Critical9.8Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
≤3.6.2Update to 3.6.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.6.5.1Update to 3.6.5.2
- Medium5.3Unauthenticated Information Exposure
<3.6.5.2Update to 3.6.5.2
- Medium5.3Missing Authorization to Unauthenticated JetEngine Options Page Modification
≤3.6.2Update to 3.6.2.1
- Critical9.8Unauthenticated Arbitrary Shortcode Execution
<3.6.5.2Update to 3.6.5.2
- Medium5.3Unauthenticated Email Header Injection
<3.6.5.2Update to 3.6.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
<3.6.5.2Update to 3.6.5.2
- Medium5.3Missing Authorization
≤3.6.4.1Update to 3.6.4.2
- Medium5.3Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
≤3.6.3Update to 3.6.3.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.6.0.1Update to 3.6.1
- High8.8Authenticated (Subscriber+) Privilege Escalation
≤3.6.1Update to 3.6.1.1
- High8.8Authenticated (Contributor+) Remote Code Execution
≤3.5.6.1Update to 3.5.6.2
- High7.5Unauthenticated Arbitrary File Read via Media Field
≤3.5.6.2Update to 3.5.6.3
- Medium5.3Missing Authorization to Unauthenticated Form Generation
≤3.5.3Update to 3.5.4
- Medium5.3Missing Authorization
≤3.5.3Update to 3.5.4
- Medium6.6Authenticated (Administrator+) PHP Object Injection
≤3.5.1.2Update to 3.5.2
- High7.2Authenticated (Administrator+) Privilege Escalation
≤3.3.4.1Update to 3.3.4.2
- Medium5.3Unauthenticated Content Injection
≤3.1.4Update to 3.1.5
- High8.8Authenticated (Author+) Privilege Escalation
≤3.0.8Update to 3.0.9
- Medium4.3Cross-Site Request Fogery via 'do_admin_action'
≤3.0.6Update to 3.0.7
JetFormBuilder — Dynamic Blocks Form Builder: common questions
Does JetFormBuilder — Dynamic Blocks Form Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 37 known vulnerabilities in JetFormBuilder — Dynamic Blocks Form Builder: 2 critical, 16 high, 19 medium. None are known to affect version null.
How do I check which version of JetFormBuilder — Dynamic Blocks Form Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent JetFormBuilder — Dynamic Blocks Form Builder vulnerability?
CVE-2026-123482, published Nov 7, 2026: JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any JetFormBuilder — Dynamic Blocks Form Builder vulnerability listed in CISA KEV?
No. None of the known JetFormBuilder — Dynamic Blocks Form Builder vulnerabilities is currently listed in the CISA KEV catalog.