Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: JetFormBuilder — Dynamic Blocks Form Builder 3.6.5.2 Clear all filters
TI-2026-16106 CVE-2026-19861 · GHSA-j6wc-w47f-c97j

JetFormBuilder < 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails

Priority LOW 21

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthent…

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00219 Published 2026-09-05 Fixed in 3.6.5.2 CWE-79
TI-2026-16103 CVE-2026-19858 · GHSA-j6jp-8fp4-2rqv

JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset

Priority LOW 39

The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arb…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00434 Published 2026-09-05 Fixed in 3.6.5.2 CWE-200