13 matches found
WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.5.3 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin JetFormBuilder versions = 3.6.5.3...
CVE-2026-92212
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...
CVE-2026-92212 JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...
EUVD-2026-86534
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...
CVE-2026-19860: External Control of File Name or Path
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary...
CVE-2026-12793: Improper Privilege Management
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.2. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content ...
CVE-2026-19861: Improper Neutralization of Input During Web Page Generation
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrato...
CVE-2026-19858: Exposure of Sensitive Information to an Unauthorized Actor
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...
CVE-2026-13459: Missing Authorization
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...
EUVD-2023-37382
Malicious code in bioql PyPI...
CVE-2023-33212
Cross-Site Request Forgery CSRF vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin = 3.0.6 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin = 3.0.6 versions...
CVE-2023-33212
CVE-2023-33212 : Crocoblock JetFormBuilder — Dynamic Blocks Form Builder plugin with version <= 3.0.6 contains a CSRF vulnerability (unauthenticated). The issue is mitigated by upgrading to version 3.0.7 or later. Multiple sources confirm the vulnerability details and patch, e.g., PatchStack n...