JetFormBuilder — Dynamic Blocks Form Builder — Vulnerabilities & Security Advisories 7

All 7 CVE vulnerabilities found in JetFormBuilder — Dynamic Blocks Form Builder, with AI-generated Chinese analysis, references, and POCs.

Vendor: Crocoblock

CVE ID	Title	CVSS	Severity	Published
CVE-2026-19861	JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails	-	-	2026-09-05
CVE-2026-19858	JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset	-	-	2026-09-05
CVE-2026-13459	JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter CWE-862	5.3	Medium	2026-07-02
CVE-2026-4373	JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field CWE-36	7.5	High	2026-03-21
CVE-2025-11991	JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation CWE-862	5.3	Medium	2025-12-16
CVE-2024-7291	JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation CWE-269	7.2	High	2024-08-03
CVE-2023-33212	WordPress JetFormBuilder Plugin <= 3.0.6 is vulnerable to Cross Site Request Forgery (CSRF) CWE-352	4.3	Medium	2023-05-28

All 7 known CVE vulnerabilities affecting JetFormBuilder — Dynamic Blocks Form Builder with full Chinese analysis, references, and POCs where available.