JetFormBuilder — Vulnerabilities & Security Advisories 13

All 13 CVE vulnerabilities found in JetFormBuilder, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-107431	WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability CWE-862	7.5	High	2026-10-14
CVE-2026-102391	WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability CWE-79	7.1	High	2026-09-30
CVE-2026-84817	WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability CWE-79	7.1	High	2026-09-08
CVE-2026-19862	JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action	4.8	Medium	2026-09-06
CVE-2026-19859	JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter	6.5	Medium	2026-09-06
CVE-2026-28140	WordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability CWE-862	7.5	High	2026-08-06
CVE-2026-54196	WordPress JetFormBuilder plugin <= 3.6.1 - Privilege Escalation vulnerability CWE-266	6.8	Medium	2026-06-17
CVE-2026-54195	WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability CWE-79	7.1	High	2026-06-17
CVE-2026-32525	WordPress JetFormBuilder plugin <= 3.5.6.1 - Remote Code Execution (RCE) vulnerability CWE-94	9.9	Critical	2026-03-25
CVE-2025-64384	WordPress JetFormBuilder plugin <= 3.5.3 - Broken Access Control vulnerability CWE-862	5.3	Medium	2025-11-13
CVE-2025-53990	WordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection Vulnerability CWE-502	7.2	High	2025-07-16
CVE-2023-37866	WordPress JetFormBuilder plugin <= 3.0.8 - Authenticated Privilege Escalation vulnerability CWE-269	7.2	High	2024-05-17
CVE-2023-48763	WordPress JetFormBuilder plugin <= 3.1.4 - Content Injection vulnerability CWE-80	5.3	Medium	2024-04-24

All 13 known CVE vulnerabilities affecting JetFormBuilder with full Chinese analysis, references, and POCs where available.