# Crocoblock JetFormBuilder vulnerabilities Source: https://junglewise.ai/threats/technologies/jetformbuilder Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/jetformbuilder.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 24 vulnerabilities in Crocoblock JetFormBuilder: 5 in the last 7 days and 21 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-123482, was published on 9 November 2026. 8 vulnerabilities in the last four weeks, up 33% on the four before (6). 1 critical against 1. ## Counts - Last 7 days: 5 - Last 30 days: 10 - Last 90 days: 21 - All time: 24 (2 critical, 0 exploited in the wild) ## About Crocoblock JetFormBuilder A WordPress plugin for building dynamic forms with custom field mapping and conditional logic. ## Latest Crocoblock JetFormBuilder vulnerabilities - [CVE-2026-123482: Crocoblock JetFormBuilder stored cross-site scripting](https://junglewise.ai/threats/cve-2026-123482-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 9 Nov 2026) - [CVE-2026-123484: Crocoblock JetFormBuilder cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-123484-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 9 Nov 2026) - [CVE-2026-123860: Crocoblock JetFormBuilder content injection in form pages](https://junglewise.ai/threats/cve-2026-123860-improper-neutralization-of-script-related-html-tags-in-a-web) (medium, CVSS 5.3, published 7 Nov 2026) - [CVE-2026-123483: Crocoblock JetFormBuilder stored XSS in form fields](https://junglewise.ai/threats/cve-2026-123483-improper-neutralization-of-script-related-html-tags-in-a-web) (medium, CVSS 5.3, published 7 Nov 2026) - [CVE-2026-119183: JetFormBuilder Stored Cross-Site Scripting via form field mapping](https://junglewise.ai/threats/cve-2026-119183-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for) (high, CVSS 7.2, published 7 Nov 2026) - [CVE-2026-119481: Crocoblock JetFormBuilder privilege escalation](https://junglewise.ai/threats/cve-2026-119481-incorrect-privilege-assignment-vulnerability-in-crocoblock) (critical, CVSS 9.8, published 4 Nov 2026) - [CVE-2026-120561: JetFormBuilder missing capability check in Update Options](https://junglewise.ai/threats/cve-2026-120561-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for) (medium, CVSS 5.3, published 3 Nov 2026) - [CVE-2026-119480: Crocoblock JetFormBuilder path traversal arbitrary file deletion](https://junglewise.ai/threats/cve-2026-119480-improper-limitation-of-a-pathname-to-a-restricted-directory-path) (medium, CVSS 6.5, published 1 Nov 2026) - [CVE-2026-119479: Crocoblock JetFormBuilder XSS in form input handling](https://junglewise.ai/threats/cve-2026-119479-improper-neutralization-of-script-related-html-tags-in-a-web) (medium, CVSS 5.3, published 30 Oct 2026) - [CVE-2026-119482: Crocoblock JetFormBuilder broken access control vulnerability](https://junglewise.ai/threats/cve-2026-119482-missing-authorization-vulnerability-in-crocoblock-jetformbuilder) (medium, CVSS 5.3, published 30 Oct 2026) - [CVE-2026-103912: JetFormBuilder DOM-based cross-site scripting in query_var preset](https://junglewise.ai/threats/cve-2026-103912-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for) (medium, CVSS 4.7, published 10 Oct 2026) - [CVE-2026-97342: JetFormBuilder Stored Cross-Site Scripting in Select field choice meta](https://junglewise.ai/threats/cve-2026-97342-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for) (high, CVSS 7.2, published 2 Oct 2026) - [CVE-2026-102391: Crocoblock JetFormBuilder cross-site scripting](https://junglewise.ai/threats/cve-2026-102391-unauthenticated-cross-site-scripting-xss-in-jetformbuilder-3-6-5) (high, CVSS 7.1, published 30 Sep 2026) - [CVE-2026-92212: JetFormBuilder reflected XSS via URL query variable in calculated field](https://junglewise.ai/threats/cve-2026-92212-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for) (medium, CVSS 6.1, published 25 Sep 2026) - [CVE-2026-19860: JetFormBuilder arbitrary file deletion via validation callback](https://junglewise.ai/threats/cve-2026-19860-the-jetformbuilder-dynamic-blocks-form-builder-wordpress-plugin) (medium, CVSS 5.5, published 19 Sep 2026) - [CVE-2026-12793: JetFormBuilder privilege escalation in form schema parsing](https://junglewise.ai/threats/cve-2026-12793-jetformbuilder-privilege-escalation-in-form-schema-parsing) (critical, CVSS 9.8, published 16 Sep 2026) - [CVE-2026-84817: JetFormBuilder unauthenticated cross-site scripting (XSS)](https://junglewise.ai/threats/cve-2026-84817-jetformbuilder-unauthenticated-cross-site-scripting-xss) (high, CVSS 7.1, published 8 Sep 2026) - [CVE-2026-19862: JetFormBuilder email header injection in Send Email action](https://junglewise.ai/threats/cve-2026-19862-jetformbuilder-email-header-injection-in-send-email-action) (medium, CVSS 4.8, published 6 Sep 2026) - [CVE-2026-19859: JetFormBuilder arbitrary shortcode execution via status parameter](https://junglewise.ai/threats/cve-2026-19859-jetformbuilder-arbitrary-shortcode-execution-via-status-parameter) (medium, CVSS 6.5, published 6 Sep 2026) - [CVE-2026-19861: JetFormBuilder WordPress plugin HTML injection in notification emails](https://junglewise.ai/threats/cve-2026-19861-jetformbuilder-wordpress-plugin-html-injection-in-notification) (medium, CVSS 4.7, published 5 Sep 2026) - [CVE-2026-19858: JetFormBuilder authorization bypass in request resolution](https://junglewise.ai/threats/cve-2026-19858-jetformbuilder-authorization-bypass-in-request-resolution) (high, CVSS 7.5, published 5 Sep 2026) - [CVE-2026-13459: Crocoblock JetFormBuilder authorization bypass in get_from_db generator](https://junglewise.ai/threats/cve-2026-13459-crocoblock-jetformbuilder-authorization-bypass-in-get-from-db) (medium, CVSS 5.3, published 2 Jul 2026) - [CVE-2026-54196: Jetmonsters JetFormBuilder privilege escalation in WordPress plugin](https://junglewise.ai/threats/cve-2026-54196-jetmonsters-jetformbuilder-privilege-escalation-in-wordpress) (medium, CVSS 6.8, published 17 Jun 2026) - [CVE-2026-54195: Jetmonsters JetFormBuilder unauthenticated XSS](https://junglewise.ai/threats/cve-2026-54195-jetmonsters-jetformbuilder-unauthenticated-xss) (high, CVSS 7.1, published 17 Jun 2026) ## Most severe Crocoblock JetFormBuilder vulnerabilities - [CVE-2026-12793: JetFormBuilder privilege escalation in form schema parsing](https://junglewise.ai/threats/cve-2026-12793-jetformbuilder-privilege-escalation-in-form-schema-parsing) (critical, CVSS 9.8, published 16 Sep 2026) - [CVE-2026-119481: Crocoblock JetFormBuilder privilege escalation](https://junglewise.ai/threats/cve-2026-119481-incorrect-privilege-assignment-vulnerability-in-crocoblock) (critical, CVSS 9.8, published 4 Nov 2026) - [CVE-2026-19858: JetFormBuilder authorization bypass in request resolution](https://junglewise.ai/threats/cve-2026-19858-jetformbuilder-authorization-bypass-in-request-resolution) (high, CVSS 7.5, published 5 Sep 2026) - [CVE-2026-97342: JetFormBuilder Stored Cross-Site Scripting in Select field choice meta](https://junglewise.ai/threats/cve-2026-97342-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for) (high, CVSS 7.2, published 2 Oct 2026) - [CVE-2026-119183: JetFormBuilder Stored Cross-Site Scripting via form field mapping](https://junglewise.ai/threats/cve-2026-119183-the-jetformbuilder-dynamic-blocks-form-builder-plugin-for) (high, CVSS 7.2, published 7 Nov 2026) - [CVE-2026-84817: JetFormBuilder unauthenticated cross-site scripting (XSS)](https://junglewise.ai/threats/cve-2026-84817-jetformbuilder-unauthenticated-cross-site-scripting-xss) (high, CVSS 7.1, published 8 Sep 2026) - [CVE-2026-54195: Jetmonsters JetFormBuilder unauthenticated XSS](https://junglewise.ai/threats/cve-2026-54195-jetmonsters-jetformbuilder-unauthenticated-xss) (high, CVSS 7.1, published 17 Jun 2026) - [CVE-2026-123482: Crocoblock JetFormBuilder stored cross-site scripting](https://junglewise.ai/threats/cve-2026-123482-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 9 Nov 2026) - [CVE-2026-123484: Crocoblock JetFormBuilder cross-site scripting vulnerability](https://junglewise.ai/threats/cve-2026-123484-improper-neutralization-of-input-during-web-page-generation) (high, CVSS 7.1, published 9 Nov 2026) - [CVE-2026-102391: Crocoblock JetFormBuilder cross-site scripting](https://junglewise.ai/threats/cve-2026-102391-unauthenticated-cross-site-scripting-xss-in-jetformbuilder-3-6-5) (high, CVSS 7.1, published 30 Sep 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up 33% on the four before (6). 1 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 4 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 2 | 1 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 2 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 3 | 0 | 0 | | 2 Nov 2026 | 5 | 1 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## Other Crocoblock technologies - [Crocoblock JetEngine](https://junglewise.ai/threats/technologies/jetengine): 24 vulnerabilities - [Crocoblock JetElements For Elementor](https://junglewise.ai/threats/technologies/jetelements-for-elementor): 7 vulnerabilities - [Crocoblock JetSmartFilters](https://junglewise.ai/threats/technologies/jetsmartfilters): 4 vulnerabilities - [Crocoblock JetBlocks For Elementor](https://junglewise.ai/threats/technologies/jetblocks-for-elementor): 3 vulnerabilities - [Crocoblock JetBlog](https://junglewise.ai/threats/technologies/jetblog): 3 vulnerabilities - [Crocoblock JetBooking](https://junglewise.ai/threats/technologies/jetbooking): 3 vulnerabilities - [Crocoblock JetReviews](https://junglewise.ai/threats/technologies/jetreviews): 3 vulnerabilities - [Crocoblock JetSearch](https://junglewise.ai/threats/technologies/jetsearch): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Crocoblock JetFormBuilder vulnerabilities", https://junglewise.ai/threats/technologies/jetformbuilder, 12 November 2026.