{"schema_version":1,"title":"Crocoblock JetFormBuilder vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 11 vulnerabilities in Crocoblock JetFormBuilder: 1 in the last 7 days and 9 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-92212, was published on 25 September 2026.","url":"https://junglewise.ai/threats/technologies/jetformbuilder","json_url":"https://junglewise.ai/threats/technologies/jetformbuilder.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/jetformbuilder","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":3,"all_time":11,"critical":1,"exploited":0,"last_7_days":1,"last_30_days":8,"last_90_days":9,"last_365_days":11},"latest":[{"cve":"CVE-2026-92212","cvss":6.1,"epss":0.0022,"slug":"cve-2026-92212-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for","title":"JetFormBuilder reflected XSS via URL query variable in calculated field","severity":"medium","exploited":false,"published_at":"2026-09-25T07:16:55.337+00:00","url":"https://junglewise.ai/threats/cve-2026-92212-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for"},{"cve":"CVE-2026-19860","cvss":5.5,"epss":0.0023,"slug":"cve-2026-19860-the-jetformbuilder-dynamic-blocks-form-builder-wordpress-plugin","title":"JetFormBuilder arbitrary file deletion via validation callback","severity":"medium","exploited":false,"published_at":"2026-09-19T07:16:32.417+00:00","url":"https://junglewise.ai/threats/cve-2026-19860-the-jetformbuilder-dynamic-blocks-form-builder-wordpress-plugin"},{"cve":"CVE-2026-12793","cvss":9.8,"epss":0.0052,"slug":"cve-2026-12793-jetformbuilder-privilege-escalation-in-form-schema-parsing","title":"JetFormBuilder privilege escalation in form schema parsing","severity":"critical","exploited":false,"published_at":"2026-09-16T04:17:56.11+00:00","url":"https://junglewise.ai/threats/cve-2026-12793-jetformbuilder-privilege-escalation-in-form-schema-parsing"},{"cve":"CVE-2026-84817","cvss":7.1,"epss":0.0025,"slug":"cve-2026-84817-jetformbuilder-unauthenticated-cross-site-scripting-xss","title":"JetFormBuilder unauthenticated cross-site scripting (XSS)","severity":"high","exploited":false,"published_at":"2026-09-08T08:17:13.393+00:00","url":"https://junglewise.ai/threats/cve-2026-84817-jetformbuilder-unauthenticated-cross-site-scripting-xss"},{"cve":"CVE-2026-19862","cvss":4.8,"epss":0.0015,"slug":"cve-2026-19862-jetformbuilder-email-header-injection-in-send-email-action","title":"JetFormBuilder email header injection in Send Email action","severity":"medium","exploited":false,"published_at":"2026-09-06T10:17:14.563+00:00","url":"https://junglewise.ai/threats/cve-2026-19862-jetformbuilder-email-header-injection-in-send-email-action"},{"cve":"CVE-2026-19859","cvss":6.5,"epss":0.002,"slug":"cve-2026-19859-jetformbuilder-arbitrary-shortcode-execution-via-status-parameter","title":"JetFormBuilder arbitrary shortcode execution via status parameter","severity":"medium","exploited":false,"published_at":"2026-09-06T10:17:13.577+00:00","url":"https://junglewise.ai/threats/cve-2026-19859-jetformbuilder-arbitrary-shortcode-execution-via-status-parameter"},{"cve":"CVE-2026-19861","cvss":4.7,"epss":0.0017,"slug":"cve-2026-19861-jetformbuilder-wordpress-plugin-html-injection-in-notification","title":"JetFormBuilder WordPress plugin HTML injection in notification emails","severity":"medium","exploited":false,"published_at":"2026-09-05T07:17:11.563+00:00","url":"https://junglewise.ai/threats/cve-2026-19861-jetformbuilder-wordpress-plugin-html-injection-in-notification"},{"cve":"CVE-2026-19858","cvss":7.5,"epss":0.0032,"slug":"cve-2026-19858-jetformbuilder-authorization-bypass-in-request-resolution","title":"JetFormBuilder authorization bypass in request resolution","severity":"high","exploited":false,"published_at":"2026-09-05T07:17:11.467+00:00","url":"https://junglewise.ai/threats/cve-2026-19858-jetformbuilder-authorization-bypass-in-request-resolution"},{"cve":"CVE-2026-13459","cvss":5.3,"slug":"cve-2026-13459-crocoblock-jetformbuilder-authorization-bypass-in-get-from-db","title":"Crocoblock JetFormBuilder authorization bypass in get_from_db generator","severity":"medium","exploited":false,"published_at":"2026-07-02T10:16:28.247+00:00","url":"https://junglewise.ai/threats/cve-2026-13459-crocoblock-jetformbuilder-authorization-bypass-in-get-from-db"},{"cve":"CVE-2026-54196","cvss":6.8,"epss":0.0021,"slug":"cve-2026-54196-jetmonsters-jetformbuilder-privilege-escalation-in-wordpress","title":"Jetmonsters JetFormBuilder privilege escalation in WordPress plugin","severity":"medium","exploited":false,"published_at":"2026-06-17T13:20:50.96+00:00","url":"https://junglewise.ai/threats/cve-2026-54196-jetmonsters-jetformbuilder-privilege-escalation-in-wordpress"},{"cve":"CVE-2026-54195","cvss":7.1,"epss":0.0015,"slug":"cve-2026-54195-jetmonsters-jetformbuilder-unauthenticated-xss","title":"Jetmonsters JetFormBuilder unauthenticated XSS","severity":"high","exploited":false,"published_at":"2026-06-17T13:20:50.82+00:00","url":"https://junglewise.ai/threats/cve-2026-54195-jetmonsters-jetformbuilder-unauthenticated-xss"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-09-14","critical":1,"exploited":0,"vulnerabilities":2},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1}],"related":[{"name":"Crocoblock JetEngine","slug":"jetengine","vulnerabilities":15,"url":"https://junglewise.ai/threats/technologies/jetengine"},{"name":"Crocoblock JetBooking","slug":"jetbooking","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/jetbooking"},{"name":"Crocoblock JetSearch","slug":"jetsearch","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/jetsearch"}],"technology":{"hub":true,"name":"Crocoblock JetFormBuilder","slug":"jetformbuilder","vendor":{"name":"Crocoblock","slug":"crocoblock","url":"https://junglewise.ai/threats/vendors/crocoblock"},"aliases":[],"category":"library","homepage":"https://jetformbuilder.com/","repo_url":"https://github.com/Crocoblock/jetformbuilder","description":"A WordPress plugin for building dynamic forms with custom field mapping and conditional logic.","url":"https://junglewise.ai/threats/technologies/jetformbuilder"},"most_severe":[{"cve":"CVE-2026-12793","cvss":9.8,"epss":0.0052,"slug":"cve-2026-12793-jetformbuilder-privilege-escalation-in-form-schema-parsing","title":"JetFormBuilder privilege escalation in form schema parsing","severity":"critical","exploited":false,"published_at":"2026-09-16T04:17:56.11+00:00","url":"https://junglewise.ai/threats/cve-2026-12793-jetformbuilder-privilege-escalation-in-form-schema-parsing"},{"cve":"CVE-2026-19858","cvss":7.5,"epss":0.0032,"slug":"cve-2026-19858-jetformbuilder-authorization-bypass-in-request-resolution","title":"JetFormBuilder authorization bypass in request resolution","severity":"high","exploited":false,"published_at":"2026-09-05T07:17:11.467+00:00","url":"https://junglewise.ai/threats/cve-2026-19858-jetformbuilder-authorization-bypass-in-request-resolution"},{"cve":"CVE-2026-84817","cvss":7.1,"epss":0.0025,"slug":"cve-2026-84817-jetformbuilder-unauthenticated-cross-site-scripting-xss","title":"JetFormBuilder unauthenticated cross-site scripting (XSS)","severity":"high","exploited":false,"published_at":"2026-09-08T08:17:13.393+00:00","url":"https://junglewise.ai/threats/cve-2026-84817-jetformbuilder-unauthenticated-cross-site-scripting-xss"},{"cve":"CVE-2026-54195","cvss":7.1,"epss":0.0015,"slug":"cve-2026-54195-jetmonsters-jetformbuilder-unauthenticated-xss","title":"Jetmonsters JetFormBuilder unauthenticated XSS","severity":"high","exploited":false,"published_at":"2026-06-17T13:20:50.82+00:00","url":"https://junglewise.ai/threats/cve-2026-54195-jetmonsters-jetformbuilder-unauthenticated-xss"},{"cve":"CVE-2026-54196","cvss":6.8,"epss":0.0021,"slug":"cve-2026-54196-jetmonsters-jetformbuilder-privilege-escalation-in-wordpress","title":"Jetmonsters JetFormBuilder privilege escalation in WordPress plugin","severity":"medium","exploited":false,"published_at":"2026-06-17T13:20:50.96+00:00","url":"https://junglewise.ai/threats/cve-2026-54196-jetmonsters-jetformbuilder-privilege-escalation-in-wordpress"},{"cve":"CVE-2026-19859","cvss":6.5,"epss":0.002,"slug":"cve-2026-19859-jetformbuilder-arbitrary-shortcode-execution-via-status-parameter","title":"JetFormBuilder arbitrary shortcode execution via status parameter","severity":"medium","exploited":false,"published_at":"2026-09-06T10:17:13.577+00:00","url":"https://junglewise.ai/threats/cve-2026-19859-jetformbuilder-arbitrary-shortcode-execution-via-status-parameter"},{"cve":"CVE-2026-92212","cvss":6.1,"epss":0.0022,"slug":"cve-2026-92212-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for","title":"JetFormBuilder reflected XSS via URL query variable in calculated field","severity":"medium","exploited":false,"published_at":"2026-09-25T07:16:55.337+00:00","url":"https://junglewise.ai/threats/cve-2026-92212-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for"},{"cve":"CVE-2026-19860","cvss":5.5,"epss":0.0023,"slug":"cve-2026-19860-the-jetformbuilder-dynamic-blocks-form-builder-wordpress-plugin","title":"JetFormBuilder arbitrary file deletion via validation callback","severity":"medium","exploited":false,"published_at":"2026-09-19T07:16:32.417+00:00","url":"https://junglewise.ai/threats/cve-2026-19860-the-jetformbuilder-dynamic-blocks-form-builder-wordpress-plugin"},{"cve":"CVE-2026-13459","cvss":5.3,"slug":"cve-2026-13459-crocoblock-jetformbuilder-authorization-bypass-in-get-from-db","title":"Crocoblock JetFormBuilder authorization bypass in get_from_db generator","severity":"medium","exploited":false,"published_at":"2026-07-02T10:16:28.247+00:00","url":"https://junglewise.ai/threats/cve-2026-13459-crocoblock-jetformbuilder-authorization-bypass-in-get-from-db"},{"cve":"CVE-2026-19862","cvss":4.8,"epss":0.0015,"slug":"cve-2026-19862-jetformbuilder-email-header-injection-in-send-email-action","title":"JetFormBuilder email header injection in Send Email action","severity":"medium","exploited":false,"published_at":"2026-09-06T10:17:14.563+00:00","url":"https://junglewise.ai/threats/cve-2026-19862-jetformbuilder-email-header-injection-in-send-email-action"}],"generated_at":"2026-09-26T12:07:00.15149+00:00"}