CVE-2026-12793

CVE-2026-12793 — JetFormBuilder 인증되지 않은 권한 상승 WordPress 플러그인 JetFormBuilder — Dynamic Blocks Form BuilderCrocoblock의 CVE-2026-12793 에 대한 개념 증명 스캐너 및 익스플로잇입니다. | ---|--- CVE| CVE-2026-12793 플러그인| jetformbuilder 영향 받는 버전| ≤ 3.6.2 수정 버전| 3.6.2.1+ CVSS| 9.8 심각 인증| 인증 불필요 CWE| CWE-269 — 부적절한 권한 관리 연구자...

CVE-2026-12793

CVE-2026-12793 — JetFormBuilder ≤ 3.6.2 인증되지 않은 권한 상승 → 플러그인 업로드 → RCE. 영향을 받는 버전 취약: = 3.6.3 빠른 사용법 단일 대상 확인 python poc.py -u https://target.example --mode check 전체 익스플로잇 기존 저권한 계정 필요 python poc.py -u https://target.example --mode exploit \ -nu subscriber -np 'Password123' -c id 대량 스캔 python...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin JetFormBuilder versions = 3.6.5.4...

CVE-2026-97342

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

EUVD-2026-91250

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-97342 JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-97342

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.6.5.4 . The root cause is insufficient input sanitization and output escaping within the 'choice' Post Meta via the Insert/Update Post Act...

CVE-2026-97342 JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action in all versions up to, and including, 3.6.5.4 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-104150

Name of the Vulnerable Software and Affected Versions JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress versions prior to 3.6.5.5 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can...

CVE-2026-12793

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-12793 CVE-2026-12793 JetFormBuilder 3.6.2 - jetmonsters 저는 @abraxasnull입니다. 루프백 랩입니다. 클라이언트는 CVE-2026-12793-Abraxas-Labs.py입니다. 권고문은 하나의 필드를 지목했습니다. jetenginebookingformid는 POST 필드이며, HTTP action=이 아닙니다...

CVE-2026-102391

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.4 versions...

CVE-2026-102391 WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.4 versions...

CVE-2026-102391 WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.4 versions...

CVE-2026-102391

The JetFormBuilder WordPress plugin (versions ¦3.6.5.4 ) is vulnerable to an unauthenticated Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute malicious scripts in a user's browser. No specific root cause, affected functions, or remediation details are prov...

EUVD-2026-90224

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.4 versions...

CVE-2026-102391: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.4 versions...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.5.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin JetFormBuilder versions = 3.6.5.3...

CVE-2026-92212

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...

EUVD-2026-86534

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-92212 JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...