Now officially on WordPress.org

CVE Database / CVE-2025-11991

CVE · Medium

CVE-2025-11991 — JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.5.4

CVE Vulnerability Type Severity Affected Fixed in Published Status
CVE-2025-11991 JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.5.4 Missing Authorization Medium 5.3 < 3.5.4 3.5.4 2025-12-15 —

CVE-2025-11991

The JetFormBuilder plugin for WordPress has a security flaw that allows unauthorized users to manipulate data because the run_callback function doesn't verify user permissions in versions prior to 3.5.4. This weakness enables malicious actors to create forms utilizing artificial intelligence, thereby exhausting the site's AI resource limits without authentication.

Based on public CVE data (MITRE/NVD).

Scan your WordPress site free

No signup, no credit card — enter your URL and get a security report in seconds.

Run a free scan Get the plugin (free)

See the full security page for this plugin Browse the CVE database Browse all security findings