JetFormBuilder — Dynamic Blocks Form Builder

Advanced form builder plugin for Gutenberg. Create forms from the ground up, customize the existing ones, and style them up – all in one editor.

v3.6.2.1jetmonstersUpdated 2026-06-17Added Jan 25, 202190k+ installs82% rating0% support resolved
17
Score
2,094
Errors
1,588
Warnings
+0
Change

Category Scores

Security0
Repo51
Performance96
Maintainability0

Top Issues by Category

i18n2,027
maintainability1,575
security58
supply_chain6
performance3

Issues Details

3,682 issues found in latest scan

ERROR2,023
WordPress.WP.I18n.TextDomainMismatch

Mismatched text domain. Expected 'jetformbuilder' but got 'jet-engine'.

WARNING1,070
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedNamespaceFound

Namespaces declared by a theme/plugin should start with the theme/plugin prefix. Found: "JFB_Compatibility".

WARNING254
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedHooknameFound

Hook names invoked by a theme/plugin should start with the theme/plugin prefix. Found: "'jet-form-builder/action/after-post-' . $this->get_id()".

WARNING132
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound

Global variables defined by a theme/plugin should start with the theme/plugin prefix. Found: "$$global_key".

ERROR30
missing_direct_file_access_protection

PHP file should prevent direct access. Add a check like: if ( ! defined( 'ABSPATH' ) ) exit;

WARNING26
Internal.NoCodeFound

No PHP code was found in this file and short open tags are not allowed by this install of PHP. This file may be using short open tags but PHP does not allow them.

WARNING19
PluginCheck.Security.DirectDB.UnescapedDBParameter

Unescaped parameter $actions used in $wpdb->query()\n$actions assigned unsafely at line 16.

WARNING18
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedFunctionFound

Functions declared in the global namespace by a theme/plugin should start with the theme/plugin prefix. Found: "jet_fb_action_handler".

ERROR14
WordPress.Security.EscapeOutput.OutputNotEscaped

All output should be run through an escaping function (see the Security sections in the WordPress Developer Handbooks), found '"Parent control `$parent` not found in the controls stack."'.

WARNING14
WordPress.Security.NonceVerification.Recommended

Processing form data without nonce verification.

ERROR13
badly_named_files

File and folder names must not contain spaces or special characters.

WARNING7
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound

Global constants defined by a theme/plugin should start with the theme/plugin prefix. Found: "DOING_AJAX".

WARNING6
WordPress.DB.DirectDatabaseQuery.DirectQuery

Use of a direct database call is discouraged.

ERROR6
hidden_files

Hidden files are not permitted.

WARNING5
Squiz.PHP.DiscouragedFunctions.Discouraged

The use of function ini_set() is discouraged

WARNING5
WordPress.DB.DirectDatabaseQuery.NoCaching

Direct database call without caching detected. Consider using wp_cache_get() / wp_cache_set() or wp_cache_delete().

WARNING4
WordPress.NamingConventions.PrefixAllGlobals.InvalidPrefixPassed

The "jfb/bricks/form/after" prefix is not a valid namespace/function/class/variable/constant prefix in PHP.

ERROR4
WordPress.WP.I18n.MissingTranslatorsComment

A function call to esc_html__() with texts containing placeholders was found, but was not accompanied by a "translators:" comment on the line above to clarify the meaning of the placeholders.

WARNING3
WordPress.DB.SlowDBQuery.slow_db_query_meta_key

Detected usage of meta_key, possible slow query.

WARNING3
WordPress.Security.ValidatedSanitizedInput.InputNotSanitized

Detected usage of a non-sanitized input variable: $_REQUEST['_wpnonce']

WARNING3
WordPress.Security.ValidatedSanitizedInput.InputNotValidated

Detected usage of a possibly undefined superglobal array index: $_REQUEST['_wpnonce']. Check that the array index exists before using it.

WARNING3
WordPress.Security.ValidatedSanitizedInput.MissingUnslash

$_REQUEST['_wpnonce'] not unslashed before sanitization. Use wp_unslash() or similar

WARNING3
WordPressVIPMinimum.Performance.WPQueryParams.PostNotIn_exclude

Using exclusionary parameters, like exclude, in calls to get_posts() should be done with caution, see https://wpvip.com/documentation/performance-improvements-by-removing-usage-of-post__not_in/ for more information.

WARNING2
WordPress.DB.PreparedSQL.InterpolatedNotPrepared

Use placeholders and $wpdb->prepare(); found interpolated variable $limit at "SELECT post_id, meta_value FROM {$wpdb->postmeta} WHERE meta_key = '_jet_sm_controls_values' LIMIT $limit OFFSET $offset"

WARNING2
WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedClassFound

Classes declared by a theme/plugin should start with the theme/plugin prefix. Found: "CX_Vue_UI".

Latest Snapshot

Findings

3,682

Errors

2,094

Warnings

1,588

Score History

First score snapshot

First scan completed Jun 20, 2026

v3.6.2.1 · Plugin Check 2.0.0 · Model 2026.06-mvp-static-v2

Jun 20, 2026

v3.6.2.1

17

Latest

Findings
3,682
Errors
2,094
Warnings
1,588
Plugin Check
2.0.0
Model
2026.06-mvp-static-v2

Related Plugins