High · 7.2 CVE-2025-53990 EUVD-2025-21688GHSA-xv5g-36c6-hqwj

WordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection Vulnerability

Published Jul 16, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Vendor: jetmonsters Product: JetFormBuilder

Description

Deserialization of Untrusted Data vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Object Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.1.2.

Affected products

Vendor	Product	Affected	Fixed
jetmonsters	JetFormBuilder	≤ 3.5.1.2	—

References

https://patchstack.com/database/Wordpress/Plugin/jetformbuilder/vulnerability/wordpress-jetformbuilder-plugin-3-5-1-2-php-object-injection-vulnerability?_s_id=cve vdb-entry