Skip to content
Noroxi

JetFormBuilder

jetformbuilder · plugin

Known security vulnerabilities for JetFormBuilder. Find out in seconds which version runs on your site with WP Lens.

17 known vulnerabilities

2 critical · 1 with public exploit code · latest Sep 30, 2026

Vulnerabilities

  • CVE-2026-32525

    WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability

    Critical 9.9

  • CVE-2026-12793

    JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

    Critical 9.8

  • CVE-2023-33212

    WordPress JetFormBuilder Plugin <= 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

    High 8.8

  • CVE-2026-28140

    WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability

    High 7.5

  • CVE-2026-4373

    JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field

    High 7.5

  • CVE-2025-53990

    WordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection Vulnerability

    High 7.2

  • CVE-2024-7291

    JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation

    High 7.2

  • CVE-2023-37866

    WordPress JetFormBuilder plugin <= 3.0.8 - Authenticated Privilege Escalation vulnerability

    High 7.2

  • CVE-2026-102391

    WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-84817

    WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-54195

    WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-54196

    WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability

    Medium 6.8

  • CVE-2026-92212

    JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field

    Medium 6.1

  • CVE-2026-13459

    JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter

    Medium 5.3

  • CVE-2025-11991

    JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation

    Medium 5.3

  • CVE-2025-64384

    WordPress JetFormBuilder plugin <= 3.5.3 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2023-48763

    WordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerability

    Medium 5.3

← Back to directory