Is Jetformbuilder safe?

What this plugin does

• Slug: jetformbuilder

Maintenance status

Known vulnerabilities

12 known CVEs on file for Jetformbuilder.

CVE-2026-13459

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve every distinct value stored under any arbitrary wp_postmeta key on the site — including WooCommerce billing PII such as _billing_email, _billing_phone, and _billing_address fields, order totals, attachment paths, and any third-party plugin credentials or tokens stored in post meta — provided at least one published JetFormBuilder form with a get_from_db generator field exists on the site. Exploitation requires that the target site has at least one published jet-form-builder post containing a field whose generator_function is set to get_from_db; an attacker must supply a matching form ID, field name, and generator ID in the request, but all of these can be discovered by browsing the site's public forms.

Source: CVE.org

CVE-2026-54196

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.6.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges.

Source: Wordfence

CVE-2026-54195

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.6.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Source: Wordfence

CVE-2026-32525

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.5.6.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to execute code on the server.

Source: Wordfence

CVE-2025-11991

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.

Source: CVE.org

CVE-2025-64384

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Source: Wordfence

CVE-2025-53990

The JetFormBuilder plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 3.5.1.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Source: Wordfence

CVE-2024-7291

The JetFormBuilder plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.4.1. This is due to improper restriction on user meta fields. This makes it possible for authenticated attackers, with administrator-level and above permissions, to register as super-admins on the sites configured as multi-sites.

Source: CVE.org

+ 4 more known vulnerabilities

CVE	Vulnerability	Type	Severity	Affected	Fixed in	Published	Status
CVE-2023-48763	JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.1.5	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)	Medium 5.3	< 3.1.5	3.1.5	2023-11-28	—
CVE-2023-37866	JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.0.9	Improper Privilege Management	High 7.2	< 3.0.9	3.0.9	2023-07-10	—
CVE-2023-33212	JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.0.7	Cross-Site Request Forgery (CSRF)	Medium 4.3	< 3.0.7	3.0.7	2023-05-22	—
CVE-2026-4373	JetFormBuilder — Dynamic Blocks Form Builder [jetformbuilder] < 3.5.6.3	—	Unknown	< 3.5.6.3	3.5.6.3	0000-00-00	—

CVE-2023-48763

Update the WordPress JetFormBuilder plugin to the latest available version (at least 3.1.5). Revan Arifio discovered and reported this Content Injection vulnerability in WordPress JetFormBuilder Plugin. This could allow a malicious actor to inject their own content into pages and posts of your website. This could also be abused to inject phishing pages into your website. This vulnerability has been fixed in version 3.1.5.

Source: Patchstack

CVE-2023-37866

Update the WordPress JetFormBuilder plugin to the latest available version (at least 3.0.9). Rafie Muhammad (Patchstack) discovered and reported this Privilege Escalation vulnerability in WordPress JetFormBuilder Plugin. This could allow a malicious actor to escalate their low privileged account to something with higher privileges. After this they could take full control of the website if high privileges are gained. This vulnerability has been fixed in version 3.0.9.

Source: Patchstack

CVE-2023-33212

The JetFormBuilder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.0.6. This is due to missing or incorrect nonce validation on the 'do_admin_action' function. This makes it possible for unauthenticated attackers to perform various administrative tasks in the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Source: Wordfence

CVE-2026-4373

The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to the 'Uploaded_File::set_from_array' method accepting user-supplied file paths from the Media Field preset JSON payload without validating that the path belongs to the WordPress uploads directory. Combined with an insufficient same-file check in 'File_Tools::is_same_file' that only compares basenames, this makes it possible for unauthenticated attackers to exfiltrate arbitrary local files as email attachments by submitting a crafted form request when the form is configured with a Media Field and a Send Email action with file attachment.

Source: Wordfence

How to fix it

Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.

This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.