JetFormBuilder — Dynamic Blocks Form Builder — Vulnerabilities & Security Advisories 12

All 12 CVE vulnerabilities found in JetFormBuilder — Dynamic Blocks Form Builder, with AI-generated Chinese analysis, references, and POCs.

Vendor: Crocoblock

CVE ID	Title	CVSS	Severity	Published
CVE-2026-103912	JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer CWE-79	4.7	Medium	2026-10-10
CVE-2026-97342	JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action CWE-79	7.2	High	2026-10-02
CVE-2026-92212	JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field CWE-79	6.1	Medium	2026-09-25
CVE-2026-19860	JetFormBuilder 3.5.6.2 - 3.6.5.2 - Admin+ Arbitrary File Deletion via Server-Side Validation Callback	-	-	2026-09-19
CVE-2026-12793	JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter CWE-269	9.8	Critical	2026-09-16
CVE-2026-19861	JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails	-	-	2026-09-05
CVE-2026-19858	JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset	-	-	2026-09-05
CVE-2026-13459	JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter CWE-862	5.3	Medium	2026-07-02
CVE-2026-4373	JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field CWE-36	7.5	High	2026-03-21
CVE-2025-11991	JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation CWE-862	5.3	Medium	2025-12-16
CVE-2024-7291	JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation CWE-269	7.2	High	2024-08-03
CVE-2023-33212	WordPress JetFormBuilder Plugin <= 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF) CWE-352	4.3	Medium	2023-05-28

All 12 known CVE vulnerabilities affecting JetFormBuilder — Dynamic Blocks Form Builder with full Chinese analysis, references, and POCs where available.