The vulnerability allows an attacker to embed crafted input into the query‑var parameter used by the JetFormBuilder plugin’s query_var Dynamic Preset. Because the plugin does not properly sanitise or escape this input before inserting it into the page’s DOM, an unauthenticated user can have arbitrary JavaScript executed in the context of the site. This can lead to the theft of session cookies, the execution of malicious scripts, or other client‑side compromise of the affected site’s visitors.

WordPress sites that use the JetFormBuilder — Dynamic Blocks Form Builder plugin with a version of 3.6.6 or earlier. Affects any installation where a form contains a text field configured with a query_var preset and a data-jfb-macro or JFB_FIELD:: macro reference pointing to that field.

The CVSS score of 4.7 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. Exploitation requires the attacker to lure an unsuspecting user to a URL that includes a malicious query‑var value; thus the attack vector is remote via the web. The exploit is possible only on pages that embed a form configured with the specific Dynamic Preset and macro, meaning that the scope is limited to those pages. Nonetheless, once executed, the attacker can run any client‑side code on the visiting user’s browser. The risk remains significant for any public‑facing WordPress site that has the plugin installed and configured in the vulnerable pattern.