124 matches found
CVE-2026-84817
Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...
EUVD-2026-72646
Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...
CVE-2026-84817 WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...
CVE-2026-84817 WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...
CVE-2026-84817
CVE-2026-84817 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress JetFormBuilder plugin in versions 3.6.5.1 and earlier . The flaw is reachable over the network with low complexity and no prior authentication, though user interaction is required. The CVSS 3.1 s...
PT-2026-86992
Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...
CVE-2026-19862
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...
CVE-2026-19859
The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later...
EUVD-2026-72090
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...
CVE-2026-19859
JetFormBuilder is a WordPress plugin that allows form creation. Versions before 3.6.5.2 are affected by an unauthenticated arbitrary shortcode execution vulnerability. The root cause is that the status request parameter is not properly sanitized before rendering as message content: escaping is ap...
CVE-2026-19859 JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter
The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later...
CVE-2026-19862 JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action
The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...
CVE-2026-19862
JetFormBuilder WordPress plugin versions before 3.6.5.2 are vulnerable to unauthenticated email header injection via the Send Email action. The root cause is that the plugin does not validate or strip line breaks from address values sourced from submitted form fields before including them in outg...
EUVD-2026-72089
The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later...
CVE-2026-19858
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...
CVE-2026-19861
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrato...
CVE-2026-19858
JetFormBuilder — Dynamic Blocks Form Builder , a WordPress plugin, versions before 3.6.5.2 fail to perform authorisation checks when resolving request-derived data during page rendering via Dynamic Preset . This allows unauthenticated users to read arbitrary user, post, and term properties and me...
CVE-2026-19858 JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...
EUVD-2026-71846
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, including password hashes...
CVE-2026-19861 JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails
The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivered to administrato...