Unknown Jetformbuilder — Dynamic Blocks Form Builder vulnerabilities

3 CVEs affecting Unknown Jetformbuilder — Dynamic Blocks Form Builder, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-19860, published 2026-09-19.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-19858, published 2026-09-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing…
• CVE-2026-19860, published 2026-09-19. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a…
• CVE-2026-19861, published 2026-09-05. Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days. The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it…