CVE-2025-11991: Jetmonsters Jetformbuilder — Dynamic Blocks Form Builder

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the run_callback function in all versions up to, and including, 3.5.3. This makes it possible for unauthenticated attackers to generate forms using AI, consuming site's AI usage limits.

Affected products

• Jetmonsters Jetformbuilder — Dynamic Blocks Form Builder: up to and including 3.5.3

Published 2025-12-16. Last modified 2026-10-07.