WordPress plugin
JetFormBuilder — Dynamic Blocks Form Builder security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 37 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High16
- Medium19
- Low0
All JetFormBuilder — Dynamic Blocks Form Builder vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.6.8Update to 3.6.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.6.8Update to 3.6.8.1
- High7.2Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source
≤3.6.7Update to 3.6.7.1
- High7.2Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta
≤3.6.8Update to 3.6.8.1
- High7.3Unauthenticated Privilege Escalation
≤3.6.7.1Update to 3.6.8
- High7.2Unauthenticated Arbitrary Shortcode Execution
≤3.6.7.1Update to 3.6.8
- High7.2Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
≤3.6.5.4Update to 3.6.6
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.6.5.4Update to 3.6.6
- Critical9.8Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter
≤3.6.2Update to 3.6.2.1
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.6.5.1Update to 3.6.5.2
- Critical9.8Unauthenticated Arbitrary Shortcode Execution
<3.6.5.2Update to 3.6.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
<3.6.5.2Update to 3.6.5.2
- High7.2Unauthenticated Stored Cross-Site Scripting
≤3.6.0.1Update to 3.6.1
- High8.8Authenticated (Subscriber+) Privilege Escalation
≤3.6.1Update to 3.6.1.1
- High8.8Authenticated (Contributor+) Remote Code Execution
≤3.5.6.1Update to 3.5.6.2
- High7.5Unauthenticated Arbitrary File Read via Media Field
≤3.5.6.2Update to 3.5.6.3
- High7.2Authenticated (Administrator+) Privilege Escalation
≤3.3.4.1Update to 3.3.4.2
- High8.8Authenticated (Author+) Privilege Escalation
≤3.0.8Update to 3.0.9
JetFormBuilder — Dynamic Blocks Form Builder: common questions
Does JetFormBuilder — Dynamic Blocks Form Builder have known vulnerabilities?
Yes. VulnCrest Radar lists 37 known vulnerabilities in JetFormBuilder — Dynamic Blocks Form Builder: 2 critical, 16 high, 19 medium. None are known to affect version null.
How do I check which version of JetFormBuilder — Dynamic Blocks Form Builder I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent JetFormBuilder — Dynamic Blocks Form Builder vulnerability?
CVE-2026-123482, published Nov 7, 2026: JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting. Severity: High (CVSS 7.2).
Is any JetFormBuilder — Dynamic Blocks Form Builder vulnerability listed in CISA KEV?
No. None of the known JetFormBuilder — Dynamic Blocks Form Builder vulnerabilities is currently listed in the CISA KEV catalog.