JetFormBuilder — Dynamic Blocks Form Builder Security & Risk Analysis

The plugin "jetformbuilder" v3.5.6.2 exhibits a mixed security posture. While it demonstrates good practices such as a high percentage of prepared SQL statements and properly escaped output, there are significant concerns regarding its attack surface. The presence of 3 AJAX handlers without authentication checks represents a direct entry point for unauthenticated attackers to potentially exploit. Furthermore, a history of 7 known CVEs, including 2 high-severity vulnerabilities related to missing authorization and privilege management, suggests recurring security weaknesses. The types of past vulnerabilities also indicate a pattern of issues that could allow unauthorized actions or data manipulation. The absence of critical taint analysis findings is a positive sign, but the inherent risks from unprotected AJAX endpoints and the historical vulnerability trend necessitate caution.