Jetformbuilder
Monthly
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions through 3.6.5.1, allowing a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The CVSS vector (PR:N/UI:R/S:C) confirms no authentication is needed to craft a malicious payload, but exploitation requires social engineering to lure a logged-in user into clicking a crafted URL. No public exploit code or CISA KEV listing is identified at time of analysis, though the plugin's wide deployment in WordPress form-building workflows elevates the realistic exposure surface.
Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attackers to perform privileged actions due to missing authorization checks (CWE-862), resulting in high integrity impact. Reported by Patchstack, the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, and no special configuration beyond having the plugin installed and active. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated reflected/stored cross-site scripting in the JetFormBuilder WordPress plugin versions 3.6.0.1 and earlier allows remote attackers to inject script into pages rendered to victims. Exploitation requires a victim to interact with a crafted link or form (UI:R), and successful payload execution can hijack sessions or perform actions in the victim's browser context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
A Code Injection vulnerability (CWE-94) exists in JetFormBuilder versions up to and including 3.5.6.1, allowing attackers to inject and execute arbitrary code within the application context. The vulnerability affects the JetFormBuilder plugin for WordPress across all versions through 3.5.6.1, and an attacker can leverage this to achieve Remote Code Execution (RCE) by injecting malicious code through form-processing mechanisms. Patchstack has documented this vulnerability with an assigned EUVD ID (EUVD-2026-15889), and while a CVSS score has not been formally assigned, the RCE classification indicates critical severity.
Email header injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated attackers to manipulate outgoing email headers by submitting CRLF sequences in form address fields. Exploitation enables adding hidden recipients via BCC, spoofing the sender address, and abusing the victim site's trusted email reputation as a phishing or spam relay. A publicly available exploit entry is documented by WPScan, though exploitation requires a non-default configuration in which the plugin is explicitly set to source message address headers from user-submitted form fields.
Shortcode injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated remote attackers to execute any shortcode registered on the target WordPress site. The flaw stems from a misordered sanitization pipeline: user-supplied input in a request parameter is HTML-escaped before it is passed to WordPress's shortcode expansion function rather than after, meaning shortcode syntax survives the escape pass intact and is then evaluated server-side. A publicly available proof-of-concept exploit exists via WPScan, making this immediately actionable for attackers against unpatched installs.
Privilege escalation in JetFormBuilder WordPress plugin versions 3.6.1 and earlier allows authenticated subscribers to elevate their role to a higher-privileged level within the WordPress instance. The root cause is incorrect privilege assignment (CWE-266) in the plugin's form processing logic, enabling the lowest authenticated WordPress user role to gain unauthorized administrative or elevated access. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS reflects high confidentiality and integrity impact if the high-complexity exploitation conditions are satisfied.
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder - Dynamic Blocks Form Builder plugin <= 3.0.6 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions through 3.6.5.1, allowing a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The CVSS vector (PR:N/UI:R/S:C) confirms no authentication is needed to craft a malicious payload, but exploitation requires social engineering to lure a logged-in user into clicking a crafted URL. No public exploit code or CISA KEV listing is identified at time of analysis, though the plugin's wide deployment in WordPress form-building workflows elevates the realistic exposure surface.
Broken access control in the JetFormBuilder WordPress plugin (versions ≤ 3.6.4.1) allows unauthenticated remote attackers to perform privileged actions due to missing authorization checks (CWE-862), resulting in high integrity impact. Reported by Patchstack, the CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, and no special configuration beyond having the plugin installed and active. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated reflected/stored cross-site scripting in the JetFormBuilder WordPress plugin versions 3.6.0.1 and earlier allows remote attackers to inject script into pages rendered to victims. Exploitation requires a victim to interact with a crafted link or form (UI:R), and successful payload execution can hijack sessions or perform actions in the victim's browser context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
A Code Injection vulnerability (CWE-94) exists in JetFormBuilder versions up to and including 3.5.6.1, allowing attackers to inject and execute arbitrary code within the application context. The vulnerability affects the JetFormBuilder plugin for WordPress across all versions through 3.5.6.1, and an attacker can leverage this to achieve Remote Code Execution (RCE) by injecting malicious code through form-processing mechanisms. Patchstack has documented this vulnerability with an assigned EUVD ID (EUVD-2026-15889), and while a CVSS score has not been formally assigned, the RCE classification indicates critical severity.
Email header injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated attackers to manipulate outgoing email headers by submitting CRLF sequences in form address fields. Exploitation enables adding hidden recipients via BCC, spoofing the sender address, and abusing the victim site's trusted email reputation as a phishing or spam relay. A publicly available exploit entry is documented by WPScan, though exploitation requires a non-default configuration in which the plugin is explicitly set to source message address headers from user-submitted form fields.
Shortcode injection in JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated remote attackers to execute any shortcode registered on the target WordPress site. The flaw stems from a misordered sanitization pipeline: user-supplied input in a request parameter is HTML-escaped before it is passed to WordPress's shortcode expansion function rather than after, meaning shortcode syntax survives the escape pass intact and is then evaluated server-side. A publicly available proof-of-concept exploit exists via WPScan, making this immediately actionable for attackers against unpatched installs.
Privilege escalation in JetFormBuilder WordPress plugin versions 3.6.1 and earlier allows authenticated subscribers to elevate their role to a higher-privileged level within the WordPress instance. The root cause is incorrect privilege assignment (CWE-266) in the plugin's form processing logic, enabling the lowest authenticated WordPress user role to gain unauthorized administrative or elevated access. No public exploit code or confirmed active exploitation has been identified at time of analysis; CVSS reflects high confidentiality and integrity impact if the high-complexity exploitation conditions are satisfied.
Cross-Site Request Forgery (CSRF) vulnerability in Crocoblock JetFormBuilder - Dynamic Blocks Form Builder plugin <= 3.0.6 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.