235 matches found
CVE-2026-119482
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.7.1...
CVE-2026-119479
The Crocoblock JetFormBuilder WordPress plugin (versions up to and including 3.6.7.1 ) is vulnerable to a Content Injection vulnerability. The root cause is the Improper Neutralization of Script-Related HTML Tags in a web page, leading to Basic XSS . This flaw allows for code injection within the...
CVE-2026-119482
The Crocoblock JetFormBuilder plugin for WordPress (versions through 3.6.7.1 ) is vulnerable to a Missing Authorization issue. This flaw allows for exploiting Incorrectly Configured Access Control Security Levels . While the CVSS score indicates a medium severity (5.3) with low complexity and no ...
CVE-2026-12793
CVE-2026-12793 — JetFormBuilder Unauthenticated Privilege Escalation Proof-of-concept scanner and exploit for CVE-2026-12793 in the WordPress plugin JetFormBuilder — Dynamic Blocks Form Builder Crocoblock. | ---|--- CVE| CVE-2026-12793 Plugin| jetformbuilder Affected| ≤ 3.6.2 Fixed in| 3.6.2.1+...
CVE-2026-12793
abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · CVE-2026-12793 CVE-2026-12793 JetFormBuilder 3.6.2 - jetmonsters I am @abraxasnull. Loopback lab. The client is CVE-2026-12793-Abraxas-Labs.py. The advisory named a field. jetenginebookingformid is a POST field, not...
CVE-2026-12793
CVE-2026-12793 — JetFormBuilder ≤ 3.6.2 Unauthenticated privilege escalation → plugin upload → RCE. Affected Versions Vulnerable: = 3.6.3 Quick Usage Check single target python poc.py -u https://target.example --mode check Full exploit requires an existing low-privilege account python poc.py -u...
CVE-2026-107431
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6...
CVE-2026-107431 WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6...
CVE-2026-107431 WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6...
CVE-2026-107431
The Crocoblock JetFormBuilder WordPress plugin (versions up to and including 3.6.6 ) is vulnerable to a Missing Authorization issue. This flaw allows for Exploiting Incorrectly Configured Access Control Security Levels , potentially leading to unauthorized access. No specific exploit details or r...
EUVD-2026-100986
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6...
PT-2026-113996
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6...
CVE-2026-107431: Missing Authorization
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6...
WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Intrudify in WordPress Plugin JetFormBuilder versions = 3.6.6...
CVE-2026-103912
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-103912 JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-103912
The JetFormBuilder WordPress plugin (versions 3.6.6 and below ) is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping involving the parameter. Unauthenticated attackers can inject arbitrary web scripts by tricking ...
EUVD-2026-96113
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2026-103912 JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
PT-2026-109499
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...