¿Es seguro Jetformbuilder?

Qué hace este plugin

• Slug: jetformbuilder
• Autor: jetmonsters
• 80000+ instalaciones activas
• 82/100 calificación (70 reseñas en wordpress.org)
• 1946295 descargas totales
• En WordPress.org desde 2021-01-25

blockscontact formform builderformsgutenberg

Estado de mantenimiento

• Última actualización: 2026-07-21 7:04am GMT
• Probado hasta WordPress: 7.0.2
• Requiere PHP: 7.0+

Vulnerabilidades conocidas

12 CVEs conocidos registrados para Jetformbuilder.

CVE-2026-13459

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2026-54196

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-54195

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.6.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-32525

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-11991

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2025-64384

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-53990

The JetFormBuilder plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.5.1.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-7291

The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

+ 4 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2023-48763	JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.1.5	Neutralización incorrecta de etiquetas HTML relacionadas con scripts en una página web (XSS básico)	Media 5,3	< 3.1.5	3.1.5	2023-11-28	—
CVE-2023-37866	JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.0.9	Gestión incorrecta de privilegios	Alta 7,2	< 3.0.9	3.0.9	2023-07-10	—
CVE-2023-33212	JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.0.7	Falsificación de petición en sitios cruzados (CSRF)	Media 4,3	< 3.0.7	3.0.7	2023-05-22	—
CVE-2026-4373	JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.5.6.3	—	Desconocido	< 3.5.6.3	3.5.6.3	0000-00-00	—

CVE-2023-48763

Update the WordPress JetFormBuilder plugin to the latest available version (at least 3.1.5). Revan Arifio discovered and reported this Content Injection vulnerability in WordPress JetFormBuilder Plugin. This could allow a malicious actor to inject their own content into pages and posts of your website. This could also be abused to inject phishing pages into your website. This vulnerability has been fixed in version 3.1.5.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-37866

Update the WordPress JetFormBuilder plugin to the latest available version (at least 3.0.9). Rafie Muhammad (Patchstack) discovered and reported this Privilege Escalation vulnerability in WordPress JetFormBuilder Plugin. This could allow a malicious actor to escalate their low privileged account to something with higher privileges. After this they could take full control of the website if high privileges are gained. This vulnerability has been fixed in version 3.0.9.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-33212

The JetFormBuilder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.6. This is due to missing or incorrect nonce validation on the 'do_admin_action' function. This makes it possible for unauthenticated attackers to perform various administrative tasks in the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2026-4373

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File_Tools::is_same_file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Contact Form 7 — 10000000+ instalaciones activas — 80/100 (2173) — PHP máx. 8.4
• Akismet Anti-spam: Spam Protection — 5000000+ instalaciones activas — 94/100 (1184) — PHP máx. 8.4
• WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More — 5000000+ instalaciones activas — 96/100 (14356)
• Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder — 700000+ instalaciones activas — 96/100 (780) — PHP máx. <8.0
• Forminator Forms – Contact Form, Payment Form & Custom Form Builder — 600000+ instalaciones activas — 96/100 (2102)