JetFormBuilder — Dynamic Blocks Form Builder

82 Quality Score

Active Installs

22/30

At 90,000 active installs it has a real user base, but it is dwarfed by mainstream form plugins like WPForms Lite at 5 million installs, which is why the popularity component only contributes moderately.

Update Freshness

25/25

An update within the same calendar period as the last sync and clean compatibility with WordPress 7.0 earn a perfect maintenance score, indicating an actively maintained codebase.

User Rating

12/15

A score of 82 out of 100 from 70 ratings is solid, though the small sample size means the rating should be treated as directional rather than definitive.

Support Health

8/15

With only one support thread tracked and zero resolved, support health is the weakest part of the profile and a meaningful risk for anyone relying on community help.

WP Compatibility

15/15

It supports WordPress 6.1 and up, requires only PHP 7.0, and has been tested against WordPress 7.0, which covers a very wide range of hosting environments.

Scores higher than 87% of indexed plugins

About

Advanced form builder plugin for Gutenberg. Create forms from the ground up, customize the existing ones, and style them up – all in one editor.

Active Installs 80k+

Rating ★★★★ 4.1/5

Last Updated 2026-09-22 3:00pm GMT

Requires WordPress 6.1+

Tested Up To 7.0.6

Requires PHP 7.0+

Security History

22 known vulnerabilities, all patched

2 Critical 8 High 12 Medium

Most recent: September 24, 2026

View details ▸

JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field Medium

September 24, 2026 Patched in ["3.6.5.4"] CVE-2026-92212

JetFormBuilder <= 3.6.5.2 - Authenticated (Administrator+) Arbitrary File Deletion Medium

September 17, 2026 Patched in ["3.6.5.3"] CVE-2026-19860

JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter Critical

September 15, 2026 Patched in ["3.6.2.1"] CVE-2026-12793

JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.5.1 - Unauthenticated Stored Cross-Site Scripting High

September 7, 2026 Patched in ["3.6.5.2"] CVE-2026-84817

JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Information Exposure Medium

September 7, 2026 Patched in ["3.6.5.2"] CVE-2026-19858

JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Email Header Injection Medium

September 3, 2026 Patched in ["3.6.5.2"] CVE-2026-19862

JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution Critical

September 3, 2026 Patched in ["3.6.5.2"] CVE-2026-19859

JetFormBuilder — Dynamic Blocks Form Builder < 3.6.5.2 - Unauthenticated Stored Cross-Site Scripting High

September 3, 2026 Patched in ["3.6.5.2"] CVE-2026-19861

JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification Medium

September 3, 2026 Patched in ["3.6.2.1"]

JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.4.1 - Missing Authorization Medium

August 4, 2026 Patched in ["3.6.4.2"] CVE-2026-28140

JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter Medium

July 1, 2026 Patched in ["3.6.3.1"] CVE-2026-13459

JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.0.1 - Unauthenticated Stored Cross-Site Scripting High

June 16, 2026 Patched in ["3.6.1"] CVE-2026-54195

JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.1 - Authenticated (Subscriber+) Privilege Escalation High

June 16, 2026 Patched in ["3.6.1.1"] CVE-2026-54196

JetFormBuilder — Dynamic Blocks Form Builder <= 3.5.6.1 - Authenticated (Contributor+) Remote Code Execution High

March 23, 2026 Patched in ["3.5.6.2"] CVE-2026-32525

JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field High

March 20, 2026 Patched in ["3.5.6.3"] CVE-2026-4373

JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation Medium

December 15, 2025 Patched in ["3.5.4"] CVE-2025-11991

JetFormBuilder <= 3.5.3 - Missing Authorization Medium

November 29, 2025 Patched in ["3.5.4"] CVE-2025-64384

JetFormBuilder <= 3.5.1.2 - Authenticated (Administrator+) PHP Object Injection Medium

July 16, 2025 Patched in ["3.5.2"] CVE-2025-53990

JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation High

August 2, 2024 Patched in ["3.3.4.2"] CVE-2024-7291

JetFormBuilder <= 3.1.4 - Unauthenticated Content Injection Medium

November 28, 2023 Patched in ["3.1.5"] CVE-2023-48763

JetFormBuilder <= 3.0.8 - Authenticated (Author+) Privilege Escalation High

July 10, 2023 Patched in ["3.0.9"] CVE-2023-37866

JetFormBuilder <= 3.0.6 - Cross-Site Request Fogery via 'do_admin_action' Medium

May 24, 2023 Patched in ["3.0.7"] CVE-2023-33212

What It Does

JetFormBuilder is a Gutenberg-native form builder that lets you assemble contact, registration, payment, and lead capture forms using dedicated blocks inside the WordPress editor. It includes conditional logic, multi-step layouts, and post-submission actions such as email notifications, custom meta storage, and integrations with CRMs and payment gateways.

Who It's For

This plugin suits WordPress users who already build pages with the block editor and want to stay in that environment rather than adopting a standalone form tool like WPForms or Formidable. It is a strong fit for agencies, freelancers, and small businesses running on Crocoblock or JetThemeCore stacks who need dynamic forms tied to custom post types and meta fields.

Who Should Skip It

If you want a plug-and-play contact form with minimal configuration, the simpler and far more popular WPForms Lite or Contact Form 7 will get you there faster. Users who depend on responsive, well-staffed support should also look elsewhere given the current 0 percent resolution rate on tracked threads.

The Bottom Line

JetFormBuilder is a capable Gutenberg-first form builder with excellent maintenance, a generous feature set, and a quality score of 81.99 out of 100. Its 0 percent support resolution rate and 90,000 installs (versus millions for competitors) make it a niche choice rather than a default recommendation. Use it if you live inside the block editor and want Crocoblock-style dynamic forms; otherwise WPForms Lite or Forminator will be safer for most people.

Choose Akismet when spam filtering on comments and submissions is the actual problem; it is not a form builder but pairs well with any of the options below.

WPForms Lite 97/100

Pick WPForms Lite for a beginner-friendly drag and drop builder, a 5 million install user base, and far more third party tutorials and support.

Spectra Legacy (Ultimate Addons for Gutenberg) 95/100

Choose Spectra when you mainly want Gutenberg blocks for layout and only need basic forms as part of a broader page building toolkit.

Forminator Forms 94/100

Pick Forminator for a free, well-rounded form, quiz, and payment plugin with a much larger 600,000 install community.

Kadence Blocks 89/100

Choose Kadence Blocks when you want a full page builder toolkit that includes simple forms but are not building complex conditional logic or post submission flows.