JetFormBuilder for WordPress enables an attacker to store malicious JavaScript via an unsanitized form field. The payload persists and activates only when a privileged user visits a form page that contains the form record preset query variable set to the attacker’s record ID. Successful exploitation results in cross‑site scripting, allowing an attacker to hijack sessions or access sensitive data (this is an inferred potential impact).

The vulnerability affects JetFormBuilder version 3.6.7 and all earlier releases installed on WordPress sites. Any site running these versions with the Save Form Record action enabled and a form‑level Form Record preset configured is susceptible.

The CVSS score of 7.2 indicates moderate severity. No EPSS score is available and the issue is not listed in CISA KEV, suggesting lower current exploitation prevalence. Nevertheless, the requirement that a privileged user open the target form increases the attack surface but does not eliminate risk, particularly on sites with active users or where privileged users regularly view form pages.