Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: JetFormBuilder 3.6.5.2 Clear all filters
TI-2026-16107 CVE-2026-19862 · GHSA-9qrj-jm5v-82p9

JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action

Priority LOW 22

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unau…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00243 Published 2026-09-06 Fixed in 3.6.5.2 CWE-93
TI-2026-16104 CVE-2026-19859 · GHSA-7cfv-gw32-qgh7

JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter

Priority LOW 35

The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on an…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00348 Published 2026-09-06 Fixed in 3.6.5.2 CWE-74