The vulnerability is an improper neutralization of user input during web page generation, identified as a stored cross‑site scripting (XSS) flaw (CWE‑79). In JetWooBuilder malicious code can be inserted into plugin‑managed content and subsequently served to all site visitors, allowing attackers to execute arbitrary JavaScript in the context of the site, which could enable defacement, credential theft, or session hijacking.

The flaw exists in Crocoblock's JetWooBuilder WordPress plugin, affecting all releases up to and including version 2.1.20.1. Site owners using WordPress with this plugin on any vulnerable version are impacted.

The CVSS score of 6.5 indicates a moderate severity exploit. The EPSS score indicates a less than 1 % probability of exploitation, and the vulnerability has not been recorded as a known exploited vulnerability in the CISA KEV catalog. Attackers would need to submit or influence data stored by the plugin, such as product descriptions or custom fields, to trigger execution. The attack vector is likely web‑based, involving form submissions or content management interfaces that the plugin exposes.