Jetformbuilder Dynamic Blocks Form Builder
Monthly
Stored cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin through version 3.6.5.4 lets unauthenticated remote attackers plant arbitrary JavaScript that later executes in the browser of any visitor viewing an affected page. The payload is submitted through the plugin's public wp_ajax_nopriv_jet_form_builder_submit endpoint, persisted verbatim into post meta by the Insert/Update Post action, and rendered without escaping by a Select Field block whose options are populated by the get_from_db generator. No confirmed active exploitation or public exploit code has been identified at time of analysis, and the impact is constrained by configuration: the payload only fires on sites that combine a publicly submittable form with an Insert/Update Post action and a Select/get_from_db field bound to the poisoned meta key.
Unauthenticated privilege escalation in JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress (versions up to and including 3.6.2) allows remote attackers to create administrator-level user accounts on affected sites. The flaw stems from missing validation that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback, enabling arbitrary user creation with maximum privileges. No public exploit code has been identified at time of analysis, but the CVSS 9.8 critical rating and lack of authentication or user interaction make this a top-priority risk for any site running the vulnerable plugin.
JetFormBuilder - Dynamic Blocks Form Builder for WordPress before version 3.6.5.2 exposes sensitive site data to unauthenticated remote attackers due to missing authorization checks during page rendering. By submitting crafted requests that reference internal WordPress data sources, attackers can read arbitrary user properties including password hashes, private and draft post content, term metadata, and secrets stored by the plugin in post metadata fields. A publicly available proof-of-concept exploit exists, and the zero-privilege network attack path makes this a credible mass-scanning target for WordPress infrastructure.
The JetFormBuilder plugin for WordPress contains a critical path traversal vulnerability allowing unauthenticated attackers to read arbitrary files from the server. All versions up to and including 3.5.6.2 are affected. Attackers can exploit this to exfiltrate sensitive local files as email attachments by submitting crafted form requests with malicious Media Field payloads, with a CVSS score of 7.5 indicating high confidentiality impact.
Reflected DOM-based cross-site scripting in the JetFormBuilder WordPress plugin (Dynamic Blocks Form Builder) affects all versions up to and including 3.6.6, allowing unauthenticated attackers to inject arbitrary web scripts via an attacker-chosen query variable whose name matches a form preset's query_var setting. Exploitation is heavily constrained: it requires a page that embeds a form containing a text field configured with a query_var Dynamic Preset together with a data-jfb-macro or JFB_FIELD:: macro reference to that field, and it also requires the victim to click an attacker-supplied link (UI:R), which is why the assessed CVSS is 4.7 with high attack complexity despite the network vector and no authentication requirement. There is no CISA KEV listing and no public exploit identified at time of analysis; the changeset in the plugin's Trac points to an upstream fix in trunk, but a patched tagged plugin release has not been independently confirmed.
Reflected cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin (all versions up to and including 3.6.5.3) allows unauthenticated attackers to inject arbitrary JavaScript into a page by supplying a crafted 'jfb_xss' URL query variable that is carried into a Calculated Field. Exploitation is not automatic: the targeted site must host a form that pairs a URL Query Variable preset field with a Calculated Field referencing that preset, and the victim must be induced to click an attacker-crafted link (UI:R), so the realistically exploitable population is a subset of installs rather than every default configuration. There is no CISA KEV listing and no public exploit identified at time of analysis, and the independent assessment rates this as a genuine but moderate-severity issue rather than a top-priority emergency.
Arbitrary file deletion in the WordPress plugin JetFormBuilder - Dynamic Blocks Form Builder (versions 3.5.6.2 through before 3.6.5.3) allows a user who can create or manage forms to point a custom field-validation callback at a PHP file-deletion function that the plugin's blocklist fails to exclude, and the deletion is then executed when the form is submitted. The weaponization step is gated behind form-management privileges (CVSS PR:H - typically an administrator or a delegated form-editor role), while the destructive submission itself requires no authentication; publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV). With a CVSS base score of 5.5 and impact limited to integrity and availability (C:N/I:L/A:L, S:C), this is a moderate-priority issue rather than a critical one, and risk is materially lower on sites that do not delegate form-management capability to untrusted users.
HTML injection via unsanitized email notifications in JetFormBuilder WordPress plugin (versions before 3.6.5.2) allows unauthenticated form submitters to embed arbitrary HTML-and conditionally JavaScript-into notification emails delivered to administrators and other configured recipients. The scope change is real: a public form submission influences the admin's email client environment rather than the WordPress server itself, with JavaScript execution gated on the recipient's mail client rendering capability. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.18% (8th percentile) reflects no widespread active exploitation; the vulnerability is not in CISA KEV.
Unauthorized wp_postmeta enumeration in JetFormBuilder (WordPress plugin, all versions through 3.6.3) allows unauthenticated remote attackers to extract arbitrary post meta values - including WooCommerce billing PII, payment tokens, and third-party plugin credentials - by exploiting a missing authorization check in the plugin's REST API generator endpoint. The flaw exists in the get_from_db generator function, which returns database values without verifying whether the requesting user is permitted to access them. No public exploit has been identified at time of analysis, but the attack is trivially executable against any site where a published JetFormBuilder form with a get_from_db field exists, as all required parameters (form ID, field name, generator ID) are discoverable by browsing the site's public forms.
Stored cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin through version 3.6.5.4 lets unauthenticated remote attackers plant arbitrary JavaScript that later executes in the browser of any visitor viewing an affected page. The payload is submitted through the plugin's public wp_ajax_nopriv_jet_form_builder_submit endpoint, persisted verbatim into post meta by the Insert/Update Post action, and rendered without escaping by a Select Field block whose options are populated by the get_from_db generator. No confirmed active exploitation or public exploit code has been identified at time of analysis, and the impact is constrained by configuration: the payload only fires on sites that combine a publicly submittable form with an Insert/Update Post action and a Select/get_from_db field bound to the poisoned meta key.
Unauthenticated privilege escalation in JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress (versions up to and including 3.6.2) allows remote attackers to create administrator-level user accounts on affected sites. The flaw stems from missing validation that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback, enabling arbitrary user creation with maximum privileges. No public exploit code has been identified at time of analysis, but the CVSS 9.8 critical rating and lack of authentication or user interaction make this a top-priority risk for any site running the vulnerable plugin.
JetFormBuilder - Dynamic Blocks Form Builder for WordPress before version 3.6.5.2 exposes sensitive site data to unauthenticated remote attackers due to missing authorization checks during page rendering. By submitting crafted requests that reference internal WordPress data sources, attackers can read arbitrary user properties including password hashes, private and draft post content, term metadata, and secrets stored by the plugin in post metadata fields. A publicly available proof-of-concept exploit exists, and the zero-privilege network attack path makes this a credible mass-scanning target for WordPress infrastructure.
The JetFormBuilder plugin for WordPress contains a critical path traversal vulnerability allowing unauthenticated attackers to read arbitrary files from the server. All versions up to and including 3.5.6.2 are affected. Attackers can exploit this to exfiltrate sensitive local files as email attachments by submitting crafted form requests with malicious Media Field payloads, with a CVSS score of 7.5 indicating high confidentiality impact.
Reflected DOM-based cross-site scripting in the JetFormBuilder WordPress plugin (Dynamic Blocks Form Builder) affects all versions up to and including 3.6.6, allowing unauthenticated attackers to inject arbitrary web scripts via an attacker-chosen query variable whose name matches a form preset's query_var setting. Exploitation is heavily constrained: it requires a page that embeds a form containing a text field configured with a query_var Dynamic Preset together with a data-jfb-macro or JFB_FIELD:: macro reference to that field, and it also requires the victim to click an attacker-supplied link (UI:R), which is why the assessed CVSS is 4.7 with high attack complexity despite the network vector and no authentication requirement. There is no CISA KEV listing and no public exploit identified at time of analysis; the changeset in the plugin's Trac points to an upstream fix in trunk, but a patched tagged plugin release has not been independently confirmed.
Reflected cross-site scripting in the JetFormBuilder - Dynamic Blocks Form Builder WordPress plugin (all versions up to and including 3.6.5.3) allows unauthenticated attackers to inject arbitrary JavaScript into a page by supplying a crafted 'jfb_xss' URL query variable that is carried into a Calculated Field. Exploitation is not automatic: the targeted site must host a form that pairs a URL Query Variable preset field with a Calculated Field referencing that preset, and the victim must be induced to click an attacker-crafted link (UI:R), so the realistically exploitable population is a subset of installs rather than every default configuration. There is no CISA KEV listing and no public exploit identified at time of analysis, and the independent assessment rates this as a genuine but moderate-severity issue rather than a top-priority emergency.
Arbitrary file deletion in the WordPress plugin JetFormBuilder - Dynamic Blocks Form Builder (versions 3.5.6.2 through before 3.6.5.3) allows a user who can create or manage forms to point a custom field-validation callback at a PHP file-deletion function that the plugin's blocklist fails to exclude, and the deletion is then executed when the form is submitted. The weaponization step is gated behind form-management privileges (CVSS PR:H - typically an administrator or a delegated form-editor role), while the destructive submission itself requires no authentication; publicly available exploit code exists, though there is no confirmed active exploitation (CISA KEV). With a CVSS base score of 5.5 and impact limited to integrity and availability (C:N/I:L/A:L, S:C), this is a moderate-priority issue rather than a critical one, and risk is materially lower on sites that do not delegate form-management capability to untrusted users.
HTML injection via unsanitized email notifications in JetFormBuilder WordPress plugin (versions before 3.6.5.2) allows unauthenticated form submitters to embed arbitrary HTML-and conditionally JavaScript-into notification emails delivered to administrators and other configured recipients. The scope change is real: a public form submission influences the admin's email client environment rather than the WordPress server itself, with JavaScript execution gated on the recipient's mail client rendering capability. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.18% (8th percentile) reflects no widespread active exploitation; the vulnerability is not in CISA KEV.
Unauthorized wp_postmeta enumeration in JetFormBuilder (WordPress plugin, all versions through 3.6.3) allows unauthenticated remote attackers to extract arbitrary post meta values - including WooCommerce billing PII, payment tokens, and third-party plugin credentials - by exploiting a missing authorization check in the plugin's REST API generator endpoint. The flaw exists in the get_from_db generator function, which returns database values without verifying whether the requesting user is permitted to access them. No public exploit has been identified at time of analysis, but the attack is trivially executable against any site where a published JetFormBuilder form with a get_from_db field exists, as all required parameters (form ID, field name, generator ID) are discoverable by browsing the site's public forms.