Jetmonsters JetFormBuilder — Dynamic Blocks Form Builder

• CVE-2026-121977 Medium 5.4 JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property –
• CVE-2026-111317 High 7.2 JetFormBuilder <= 3.6.7 - Unauthenticated Stored Cross-Site Scripting via Form Record Preset Source –
• CVE-2026-119183 High 7.2 JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via '%META::key%' Macro via Post Meta –
• CVE-2026-120561 Medium 5.3 JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification 0.3%
• CVE-2026-103912 Medium 4.7 JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer 0.2%
• CVE-2026-97342 High 7.2 JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action 0.2%
• CVE-2026-92212 Medium 6.1 JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field 0.3%
• CVE-2026-12793 Critical 9.8 JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter 0.5%
• CVE-2026-13459 Medium 5.3 JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter 0.6%
• CVE-2026-4373 High 7.5 JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field 0.4%
• CVE-2025-11991 Medium 5.3 JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation 0.2%
• CVE-2024-7291 High 7.2 JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation 0.5%